Security baseline

Goal

Define the minimum security posture required for every Beacon environment before moving to production.

Mandatory checklist

1. 11) Secrets and credentials

   Store secrets in a dedicated vault, rotate automatically, and never expose them in code, logs, or public docs.

2. 22) Access and permissions

   Enforce least privilege per persona, run periodic role reviews, and remove orphaned access.

3. 33) Event integrity

   Enable webhook signature validation, verify timestamp, and enforce idempotency end-to-end.

4. 44) Audit and traceability

   Guarantee request_id, audit trail, and minimum retention for investigations.

5. 55) Incident response

   Maintain validated runbooks and escalation contacts.

Control matrix by domain

Forbidden patterns

• Real credentials in documentation examples.
• Internal/dev-only endpoints in public docs.
• Full personal data exports through uncontrolled channels.