security-review

auth:
  - authentication required for non-public endpoints
  - authorization rules documented and tested
data:
  - secrets stored outside source control
  - encryption in transit enabled