laravel_school_api_old/docs/release/security-readiness.md

Security Readiness Review

Required checks before production rollout:

• Cross-school access tests pass.
• Wrong-role access tests pass.
• Payment file access is payment-scoped and authorized.
• Bulk communication requires preview and confirmation token.
• Report export requires explicit export permission.
• Extension routes require islamic_sunday_school domain profile.
• Sensitive Islamic Sunday School profile fields require explicit permission.
• Provider callbacks are signature-verified where applicable.
• Risky endpoints have rate limits.

High-risk extension data includes imam/admin sensitive notes, Qur'an/Arabic/Islamic studies placement details, scholarship/sadaqah support indicators, family/community profile notes, and guardian contact information.