cybersecurity-checklisted

# Cybersecurity & GDPR Check A structured, evidence-based check of a project's backend, frontend, and deployment against application-security best practice and EU data-protection law — not a live penetration test and not legal advice. It investigates the codebase, configuration, and (where relevant) live DNS/HTTP endpoints, and reports one table the user can act on. ## Ground rules - **Evidence or it didn't happen.** Every row needs a concrete pointer — a `file:line`, a grep match, a command's actual output, or (for things code can't answer) an explicit note that this needs a human/legal decision. Don't mark something ✅ because it "looks fine" or "is standard" — either you found the safeguard in the code/config, or you didn't. - **This is static investigation, not runtime testing, and not a legal opinion.** A ✅ on a security check means the code contains the safeguard as far as you could read it. A ✅ on a GDPR check means the documentary/technical evidence for compliance exists — it is not a lawyer's sign-off. Say both caveats once, up front, in the report so the user doesn't over-trust the result. Never phrase a finding as "this is GDPR-compliant" — phrase it as "the evidence for X is present/absent." - **Some checks are not code problems.** SPF/DKIM/DMARC live in DNS, not the repo. DPA/AVV coverage, a DPIA, a retention policy, and EU-regulation applicability are legal/organizational facts a codebase can't fully prove or disprove — code review can only