External Deployment Tasks

Update to create or link issues as needed

# Security Tasks

## Secrets & Configuration
- [x] Add `secrets.env` to `.gitignore` _{(CIS 3.4, NIST SC-28)}
- [x] Use a secrets vault (e.g., Azure Key Vault) _{(CIS 3.4)}
- [x] Review `.env` for hardcoded secrets and remove them _{(CIS 3.4)}

## Dependency & Supply Chain
- [x] Run `npm audit` and resolve all high/critical vulnerabilities _{(CIS 2.3, 16.11)}
- [x] Package scanning using grype
- [x] #145
- [x] #146
- [x] #134
- [x] Track packages using a Software Bill of Materials (SBOM) _{(NIST SSDF PW.5.2)}
- [x] #145
- [x] #146
- [x] #134
- [x] Enable GitHub Dependabot or Snyk alerts _{(CIS 2.3)}
- [x] Lock versions in `package-lock.json` _{(CIS 2.3)}

## Input Validation
- [x] #217
- [x] Frontend Sanitize all user input (client-side and API-bound)
- [x] #218
- [x] Frontend XSS Escape HTML/JS in dynamic rendering
- [x] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
- [x] https://www.invicti.com/blog/web-security/is-react-vulnerable-to-xss/
- [x] Validate AI prompt inputs and responses for safety _{(CSA AI Safety 3.1)}
- [x] NA, covered by image security policies
- [x] #219
- [x] Frontend Apply schema validation to API responses
- [x] Backend schema validation between services

## Browser Security
- [x] #220
- [x] https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/CSP
- [x] #221
- [x] https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/SRI
- [x] #222
- [x] https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/MIME_types
- [x] https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Referrer_policy

## AI Safety
- [x] Implement input filtering before sending prompts _{(OWASP LLM Top 10)}
- [x] NA, covered by image security policies

## Access Control
- [x] #223
- [x] Infra Enforce MFA on developer accounts
- [x] #224
- [x] Infra setup entra
- [x] create application token in entra
- [x] Frontend integrate oauth library
- [x] Backend create authz middleware in the api layer
- [x] #225
- [x] Frontend RBAC hide of ui elements
- [x] Backend RBAC middleware
- [x] #226
- [x] Frontend OAuth store tokens in memory
- [x] #252
- [x] #253

## CI/CD
- [x] Require code review for all pull requests _{(NIST SSDF PW.7.1)}
- [x] #251
- [x] #191
- [x] #215

## File Handling
- [x] #227
- [x] Infra Azure blob storage malware scan
- [x] #228
- [x] Backend see cdr proc
- [x] #229
- [x] Backend Restrict uploads to trusted image types (.jpg, .png, .webp) and verify MIME type using content inspection
- [x] Frontend Restrict uploads to trusted image types (.jpg, .png, .webp) and verify MIME type using content inspection
- [x] #230
- [x] Backend Strip all image metadata (EXIF, comments, thumbnails)
- [x] #231
- [x] Frontend Enforce size and dimension limits on uploaded images
- [x] Backend Enforce size and dimension limits on uploaded images
- [x] Use atomic file validation and storage to avoid TOCTOU race conditions _{(OWASP Unrestricted File Upload)}
- [x] Azure Blob storage scans for malware in the background or when the file is read if it has not been scanned yet
- [x] Do not store uploaded files in webroot; use randomized filenames and object storage _{(OWASP Unrestricted File Upload)}
- [x] Strip user-supplied file names; generate server-side unique names _{(OWASP File Upload Security)}
- [x] #232
- [x] Frontend Log all file upload activity with metadata (user, time, size, hash, scan status)
- [x] Backend Log all file upload activity with metadata (user, time, size, hash, scan status)
- [x] #233
- [x] Backend Sharp (node) or Rasterio (python) sanitize image content
- [x] #234
- [x] Backend Generate and store a hash (SHA-256) for each uploaded file

# Tasks Infra

- [ ] #235
- [x] #236
- [x] #237
- [x] #241
- [x] #242
- [x] #243
- [x] #244
- [x] #245
- [x] #246
- [x] #247
- [x] #249
- [x] #278
- [ ] #279
- [x] #280
- [x] #281
- [ ] #282
- [x] #283
- [x] #296
- [x] #305
- [x] #310
- [x] #358
- [x] #385
- [ ] #386

### (monitoring)
- [x] #188
- [ ] #189
- [x] #190
- [x] #255

# Tasks unsorted

- [x] #238
- [x] #239
- [x] #240
- [x] #248
- [x] #250