# TRO-M08: Security review checklist for obfuscated widget
**Area:** Widget.js Telnyx Obfuscation
**Model:** minimax/minimax-m2.5
**Tokens:** 2,147
**Cost:** $0.0021
**Time:** 4210ms
**Timestamp:** 2026-02-16T12:17:30.037262

---

# Security Review Checklist: Post-Obfuscation Widget Deployment

## Purpose

This checklist validates that the obfuscation process for Sunaiva Talking Widget has not introduced, exposed, or broken security controls. Complete all items before production deployment.

---

## 1. Credential & Secrets Audit

| # | Check Item | Pass | Fail | Notes |
|---|------------|------|------|-------|
| 1.1 | No API keys, tokens, or secrets appear in obfuscated output (grep for `apiKey`, `token`, `secret`, `password`, `bearer`) | ☐ | ☐ | |
| 1.2 | No AWS/Cloud credentials (access keys, secret keys) present | ☐ | ☐ | |
| 1.3 | No third-party service credentials (Twilio, Stripe, etc.) exposed | ☐ | ☐ | |
| 1.4 | All external API calls use environment variables or server-side proxy, not embedded secrets | ☐ | ☐ | |
| 1.5 | Obfuscation did not accidentally expose internal variable names that leak functionality | ☐ | ☐ | |

**Verification Command:**
```bash
# Search common secret patterns in obfuscated output
grep -Ei "(api[_-]?key|secret|password|token|bearer|aws[_-]?access|private[_-]?key)" widget.min.js
```

---

## 2. Endpoint Exposure Audit

| # | Check Item | Pass | Fail | Notes |
|---|------------|------|------|-------|
| 2.1 | No debug endpoints (`/debug`, `/test`, `/status`, `/health`) exposed in obfuscated code | ☐ | ☐ | |
| 2.2 | No verbose error endpoints or stack trace generators accessible | ☐ | ☐ | |
| 2.3 | No development-only endpoints (e.g., `/dev/`, `/admin/dev/`) reachable | ☐ | ☐ | |
| 2.4 | All production endpoints require appropriate authentication/authorization | ☐ | ☐ | |
| 2.5 | Internal function names do not reveal hidden/debug endpoints | ☐ | ☐ | |

**Verification:**
- Review all URL patterns in obfuscated code
- Confirm server-side routing rejects all non-production endpoints
- Test each suspected endpoint returns 404 or 403, not 200 with data

---

## 3. Content Security Policy (CSP) Validation

| # | Check Item | Pass | Fail | Notes |
|---|------------|------|------|-------|
| 3.1 | Widget's inline scripts are compatible with existing CSP (`unsafe-inline` evaluation) | ☐ | ☐ | |
| 3.2 | If using `unsafe-inline`, document mitigation strategy (nonce/hash) | ☐ | ☐ | |
| 3.3 | All external script src domains are whitelisted in CSP | ☐ | ☐ | |
| 3.4 | `frame-ancestors` or `X-Frame-Options` configured to prevent embedding on hostile sites | ☐ | ☐ | |
| 3.5 | CSP includes `connect-src` for any WebSocket or fetch calls the widget makes | ☐ | ☐ | |
| 3.6 | CSP report-uri or report-to configured for violation reporting | ☐ | ☐ | |

**CSP Header Example (permissive baseline):**
```
Content-Security-Policy: 
  default-src 'self'; 
  script-src 'self' 'unsafe-inline' https://cdn.sunaiva.com; 
  connect-src https://api.sunaiva.com wss://*.sunaiva.com; 
  frame-ancestors 'self' https://*.tradiepartner.com;
  report-uri https://sunaiva.com/csp-report
```

---

## 4. Subresource Integrity (SRI) Hash Recalculation

| # | Check Item | Pass | Fail | Notes |
|---|------------|------|------|-------|
| 4.1 | SHA-384 (or SHA-512) hash generated for obfuscated `widget.min.js` | ☐ | ☐ | |
| 4.2 | Hash regenerated for all dependent assets (CSS, additional JS modules) | ☐ | ☐ | |
| 4.3 | SRI attribute updated in all `<script>` and `<link>` tags across partner sites | ☐ | ☐ | |
| 4.4 | Hashes stored in partner onboarding documentation and updated in CMS | ☐ | ☐ | |
| 4.5 | Fallback verification: CDN-hosted version includes SRI in deployment pipeline | ☐ | ☐ | |

**Hash Generation Command:**
```bash
# Generate SHA-384 hash for widget.min.js
openssl dgst -sha384 -binary widget.min.js | openssl base64 -A
```

**Expected Output Format:**
```html
<script 
  src="https://cdn.sunaiva.com/widget/v2/widget.min.js"
  integrity="sha384-abc123...def456"
  crossorigin="anonymous"
></script>
```

---

## 5. Obfuscation-Specific Security Checks

| # | Check Item | Pass | Fail | Notes |
|---|------------|------|------|-------|
| 5.1 | Obfuscation did not introduce code that makes external network calls to unknown domains | ☐ | ☐ | |
| 5.2 | No eval() or Function() constructors added that could enable XSS if CSP is weak | ☐ | ☐ | |
| 5.3 | Code flow analysis confirms no data exfiltration pathways introduced | ☐ | ☐ | |
| 5.4 | Original source maps removed from production build | ☐ | ☐ | |
| 5.5 | If source maps retained for partner debugging, they are in a secured location with auth | ☐ | ☐ | |
| 5.6 | Obfuscation preserved all security-critical logic (auth token handling, input sanitization) | ☐ | ☐ | |

---

## 6. Integration & Runtime Security

| # | Check Item | Pass | Fail | Notes |
|---|------------|------|------|-------|
| 6.1 | Widget functions correctly within partner site iframe (if applicable) | ☐ | ☐ | |
| 6.2 | XSS prevention: widget properly escapes all user-supplied inputs it displays | ☐ | ☐ | |
| 6.3 | CSRF tokens present for any state-changing API calls | ☐ | ☐ | |
| 6.4 | Widget respects partner site's existing security headers | ☐ | ☐ | |
| 6.5 | No local storage or cookie storage of sensitive data without encryption | ☐ | ☐ | |
| 6.6 | Session tokens use `Secure`, `HttpOnly`, and `SameSite` attributes | ☐ | ☐ | |

---

## 7. Deployment & Distribution Verification

| # | Check Item | Pass | Fail | Notes |
|---|------------|------|------|-------|
| 7.1 | CDN deploy uses HTTPS only | ☐ | ☐ | |
| 7.2 | HSTS header enabled on CDN endpoint (includeSubdomains, preload) | ☐ | ☐ | |
| 7.3 | CDN access logs show no anomalous access patterns | ☐ | ☐ | |
| 7.4 | Widget version number incremented and documented in changelog | ☐ | ☐ | |
| 7.5 | Partner notification sent with updated embed code and SRI hashes | ☐ | ☐ | |
| 7.6 | Rollback procedure documented in case of post-deployment security issue | ☐ | ☐ | |

---

## 8. Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Security Lead | | | |
| Development Lead | | | |
| QA Lead | | | |

---

## Notes & Remediation Actions

| Issue ID | Description | Severity | Owner | Due Date | Status |
|----------|-------------|----------|-------|----------|--------|
| | | | | | |
| | | | | | |

---

**Document Version:** 1.0  
**Last Updated:** [Date]  
**Next Review:** Post next obfuscation update or quarterly, whichever comes first