Internal penetration-test checklist

Run against an isolated environment with synthetic data.

• Authentication: uniform unknown-user behavior, account/IP limits, lockout, MFA window/replay, reset single use, password history, refresh reuse/device binding, session cap, and privilege-change invalidation.
• Authorization: test missing, malformed, stale, wrong-scope, and another user’s token on every protected route. Verify own versus any.
• Input: malformed JSON, oversized bodies, wrong content types, SQL metacharacters, profile HTML, and loopback/private/data:/javascript: avatar URLs.
• Browser: CSP/clickjacking/referrer/CORS, memory-only tokens, cross-tab races, logout propagation, SRI, and absence of user-data innerHTML sinks.
• Edge: TLS 1.3, OCSP, HSTS, request-ID injection, forwarded-IP spoofing, websocket auth, and per-route body/rate policy.
• Infrastructure: restricted PSS, default deny, non-root/read-only images, signature admission, secret mounts, Redis ACLs, audit events, and Falco.
• Data: export, erasure, retention, redaction, stream signature/encryption, DLQ replay authorization, restore, and break-glass revocation.

Store versions, timestamps, evidence, and owners. Critical/high findings block release until fixed and independently re-tested.