# Penetration Testing Checklist

This document provides a comprehensive checklist for performing penetration testing on the SophiaClaw project, specifically targeting the self-hosted community edition components (Gateway, CLI, and client apps).

## 1. Information Gathering & Reconnaissance

- [ ] **Port Scanning & Service Enumeration:** Identify all open ports and exposed services on the host running the Gateway.
- [ ] **Dependency Analysis:** Run `npm audit` and tool-based scans (e.g., Retire.js, Snyk) to identify vulnerable outdated packages.
- [ ] **Source Code Review:** Review source code for hardcoded secrets, API keys, or backdoor credentials.
- [ ] **Architecture Review:** Identify trust boundaries (e.g., Gateway vs. Client, Plugin isolation).

## 2. Authentication & Authorization

- [ ] **API Access Controls:** Verify that all Gateway endpoints are properly authenticated using tokens, passwords, or trusted proxy methods.
- [ ] **Session Management:** Test the lifespan of session tokens. Ensure that revoked or expired tokens are immediately rejected.
- [ ] **Privilege Escalation:** Attempt to perform administrative actions (e.g., config changes, stopping the gateway) using a standard user token or without authentication.
- [ ] **Token Storage & Encryption:** Verify that `~/.sophiaclaw/credentials/` and sensitive config keys are encrypted at rest using AES-256-GCM.
- [ ] **Brute Force Protection:** Verify that there are rate limits or lockouts for repeated failed authentication attempts against the Gateway or Canvas host.

## 3. Data Validation & Injection

- [ ] **Input Validation:** Test all API endpoints with malformed, oversized, or unexpected data payloads (Fuzzing).
- [ ] **Command Injection:** Test CLI inputs and API endpoints that interact with the OS shell (e.g., `tools.exec.applyPatch`) to ensure commands cannot be injected.
- [ ] **Path Traversal:** Try accessing files outside the allowed workspace boundary using `../` or absolute paths in file read/write APIs.
- [ ] **Cross-Site Scripting (XSS):** If the Gateway hosts web UI components (e.g., A2UI, Canvas), test for stored and reflected XSS.

## 4. Cryptography & Data Protection

- [ ] **In-Transit Encryption:** Ensure that all non-localhost communication mandates TLS/HTTPS.
- [ ] **At-Rest Encryption:** Validate that the credential encryption mechanism correctly implements AES-GCM without hardcoded nonces or weak key derivation.
- [ ] **Log Integrity Verification:** Validate the SHA-256 log integrity hashing mechanism. Tamper with a log file and ensure the system detects the discrepancy.

## 5. Logic & Configuration Flaws

- [ ] **Default Configurations:** Check if the system is secure by default (e.g., `gateway.bind="loopback"`, `tools.fs.workspaceOnly: true`).
- [ ] **Cross-Site Request Forgery (CSRF):** For web interfaces, ensure CSRF tokens or `SameSite` cookies are employed for state-changing operations.
- [ ] **Plugin Sandboxing:** Install a malicious test plugin and attempt to read sensitive files, access restricted APIs, or escalate privileges beyond the plugin's documented capabilities.

## 6. Denial of Service (DoS) & Resource Exhaustion

- [ ] **Rate Limiting:** Send a high volume of requests to the Gateway to test if rate limiting or basic circuit breakers correctly trip and throttle.
- [ ] **Large Payloads:** Send extremely large JSON payloads or log entries to test memory exhaustion.
- [ ] **Resource Limits:** Validate that the new `ResourceMonitor` properly identifies and warns when CPU, memory, or file descriptor limits are exceeded.

## 7. Reporting & Remediation

- [ ] **Documentation:** Log all findings with clear reproduction steps, screenshots/logs, and CVSS scores.
- [ ] **Triage:** Categorize issues as Critical, High, Medium, or Low according to the `SECURITY.md` guidelines.
- [ ] **Remediation Testing:** After fixes are applied, re-test the vulnerabilities to ensure the patches are effective and haven't introduced regressions.