Security tests

Security-focused tests cover owner isolation, authorization replay/session state, SSRF/import boundaries, file/parser limits, AI sidecar authentication, PDF admission, rate limits, dependency checks, and sensitive-output handling. Keep hostile fixtures synthetic and use the repository's existing scripts/configs.

The dated audit evidence under the archive records what was and was not exercised. Manual production checks remain gates where local fixtures cannot establish the claim.