{
  "evidence_version": 2,
  "revision": "2026-06-04-cutover-security-review-784",
  "domain": "socialmedia2.com",
  "gate": "H2",
  "hosted_ci": false,
  "no_paid_operations": true,
  "pages_project": "polis-socialmedia2",
  "repository": "https://github.com/ChrisRoyse/Polis",
  "review_packet": "https://socialmedia2.com/review/pentest-request.json",
  "secret_values_public": false,
  "source_deployment_manifest": "deploy/socialmedia2.com/cloudflare-pages.json",
  "security_review": {
    "issue": 784,
    "completed": true,
    "readback": "security/pentest/cutover-security-review-784.json",
    "findings_triaged": true,
    "independent_pentest_claimed": false
  },
  "test_constraints": {
    "allowed_without_prior_coordination": [
      "static content review",
      "non-destructive GET and HEAD requests",
      "signed Stripe webhook verification using reviewer-provided test payloads",
      "repository source review",
      "unauthenticated Cloudflare Access denial checks against aiwonder hostname"
    ],
    "coordination_addresses": [
      "security@socialmedia2.com",
      "review@socialmedia2.com"
    ],
    "forbidden_without_written_approval": [
      "live customer charges",
      "destructive payloads",
      "denial-of-service testing",
      "credential stuffing",
      "social engineering",
      "paid Cloudflare or Stripe operations",
      "aiwonder load or kill testing",
      "attempts to bypass Cloudflare Access with guessed service-token values"
    ]
  },
  "trust_boundaries": [
    {
      "id": "browser_to_pages",
      "description": "Public visitor browser to Cloudflare Pages static assets and Pages Function Worker.",
      "controls": [
        "security_headers",
        "no_hosted_ci",
        "public_review_packet"
      ]
    },
    {
      "id": "pages_to_d1_vectorize_r2",
      "description": "Worker to Cloudflare storage bindings for account state, search indexes, and assets.",
      "controls": [
        "binding_only_access",
        "operator_review_filters",
        "synthetic_data_not_build_done"
      ]
    },
    {
      "id": "pages_to_aiwonder",
      "description": "Worker to aiwonder through Cloudflare Tunnel and Cloudflare Access service token.",
      "controls": [
        "outbound_only_tunnel",
        "access_service_token_required",
        "aiwonder_fallback_fts5_on_unavailable",
        "secret_names_only_in_repo"
      ]
    },
    {
      "id": "stripe_to_pages",
      "description": "Stripe webhook delivery to Pages Function.",
      "controls": [
        "stripe_signature_required",
        "five_minute_timestamp_window",
        "test_and_live_signing_secret_names_only"
      ]
    },
    {
      "id": "operator_admin",
      "description": "Current operator APIs plus planned /admin/ console.",
      "controls": [
        "synthetic_operator_token_for_current_fixture_routes",
        "server_side_rbac_required_before_admin_launch",
        "admin_session_hardening_tracked_by_750"
      ]
    }
  ],
  "components": [
    {
      "id": "cloudflare_pages",
      "surface": "Static bundle and Pages Function Worker for socialmedia2.com",
      "public_hostname": "socialmedia2.com",
      "citizen_data": true
    },
    {
      "id": "cloudflare_tunnel_access_aiwonder",
      "surface": "aiwonder inference origin behind outbound-only Cloudflare Tunnel and Access service token",
      "public_hostname": "aiwonder-sm2.socialmedia2.com",
      "citizen_data": true,
      "secret_names": [
        "aiwonder_tunnel_hostname",
        "aiwonder_access_client_id",
        "aiwonder_access_client_secret"
      ],
      "source_of_truth": [
        "ops/aiwonder/connectivity-decision.md",
        "docs/fsv/0734-aiwonder-tunnel-access-live-readback.md",
        "deploy/socialmedia2.com/aiwonder-rollback-drill-readback.json"
      ]
    },
    {
      "id": "admin_operator_surface",
      "surface": "Current venue operator APIs and planned admin console",
      "citizen_data": true,
      "live_admin_route_present": false,
      "triage_issues": [
        740,
        741,
        742,
        750,
        762,
        763,
        764,
        765,
        766
      ]
    },
    {
      "id": "stripe_payments",
      "surface": "Stripe payment links, webhook verification, billing portal ids, and support-economics ledger schema",
      "citizen_data": true,
      "secret_names": [
        "POLIS_STRIPE_LIVE_WEBHOOK_SECRET",
        "POLIS_STRIPE_LIVE_WEBHOOK_ENDPOINT_ID",
        "POLIS_STRIPE_TEST_WEBHOOK_SECRET",
        "POLIS_STRIPE_TEST_WEBHOOK_ENDPOINT_ID"
      ],
      "triage_issues": [
        751,
        752,
        753,
        754,
        755,
        756,
        757,
        758,
        759,
        760,
        761
      ]
    }
  ],
  "routes": [
    {
      "path": "/",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "static landing page",
      "citizen_data": false,
      "controls": [
        "security_headers"
      ]
    },
    {
      "path": "/events/",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "public event search frontend",
      "citizen_data": false,
      "controls": [
        "reviewed_rows_only",
        "no_engagement_ranking"
      ]
    },
    {
      "path": "/venues/",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "public venue search frontend",
      "citizen_data": false,
      "controls": [
        "reviewed_rows_only",
        "no_engagement_ranking"
      ]
    },
    {
      "path": "/account/",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "account sign-in/sign-up page",
      "citizen_data": false,
      "controls": [
        "auth_flow_entry"
      ]
    },
    {
      "path": "/account/*",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "private account pages",
      "citizen_data": true,
      "requires_authenticated_session": true,
      "controls": [
        "account_session_guard",
        "no_public_match_explanations"
      ]
    },
    {
      "path": "/onboarding/",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "onboarding intake frontend",
      "citizen_data": false,
      "controls": [
        "client_side_draft_storage",
        "auth_resume"
      ]
    },
    {
      "path": "/review/",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "external review handoff page",
      "citizen_data": false,
      "controls": [
        "noindex",
        "no_secret_values"
      ]
    },
    {
      "path": "/review/pentest-request.json",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "H2 independent pentest request packet",
      "citizen_data": false,
      "controls": [
        "secret_names_only"
      ]
    },
    {
      "path": "/review/attack-surface.json",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "H2 route-level attack-surface packet",
      "citizen_data": false,
      "controls": [
        "secret_names_only",
        "private_routes_labeled"
      ]
    },
    {
      "path": "/status/",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "public non-secret BUILD_DONE status page",
      "citizen_data": false,
      "controls": [
        "build_done_evidence_false_for_supporting_artifacts"
      ]
    },
    {
      "path": "/observability/",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "citizen-data-free observability dashboard",
      "citizen_data": false,
      "controls": [
        "aggregate_only",
        "no_raw_logs"
      ]
    },
    {
      "path": "/.well-known/security.txt",
      "methods": [
        "GET",
        "HEAD"
      ],
      "surface": "security contact policy",
      "citizen_data": false,
      "controls": [
        "rfc9116"
      ]
    },
    {
      "path": "/api/auth/*",
      "methods": [
        "GET",
        "POST"
      ],
      "surface": "Google/email auth session routes",
      "citizen_data": true,
      "controls": [
        "http_only_session_cookie",
        "state_nonce",
        "csrf_or_callback_validation",
        "logout_route"
      ]
    },
    {
      "path": "/api/onboarding/intake",
      "methods": [
        "POST"
      ],
      "surface": "onboarding intake persistence",
      "citizen_data": true,
      "controls": [
        "field_allowlist",
        "text_length_caps",
        "synthetic_marker_guard",
        "account_resume"
      ]
    },
    {
      "path": "/api/events/search",
      "methods": [
        "GET"
      ],
      "surface": "public/authenticated event search with aiwonder semantic path",
      "citizen_data": true,
      "public_without_auth": true,
      "controls": [
        "operator_reviewed_rows_only",
        "synthetic_data_excluded_public",
        "aiwonder_access_service_token",
        "fts5_fallback_labeled",
        "no_engagement_ranking"
      ]
    },
    {
      "path": "/api/venues/search",
      "methods": [
        "GET"
      ],
      "surface": "public/authenticated venue search with aiwonder semantic path",
      "citizen_data": true,
      "public_without_auth": true,
      "controls": [
        "operator_reviewed_rows_only",
        "synthetic_data_excluded_public",
        "aiwonder_access_service_token",
        "fts5_fallback_labeled",
        "no_engagement_ranking"
      ]
    },
    {
      "path": "/api/search/bindings-smoke",
      "methods": [
        "GET"
      ],
      "surface": "non-secret search binding smoke",
      "citizen_data": false,
      "controls": [
        "no_aiwonder_call",
        "no_vector_query",
        "secret_names_only"
      ]
    },
    {
      "path": "/api/search/*",
      "methods": [
        "POST"
      ],
      "surface": "operator search embedding/eval/backfill routes",
      "citizen_data": false,
      "requires_operator_signature": true,
      "controls": [
        "signed_operator_request",
        "explicit_cost_approval_header",
        "synthetic_or_reviewed_rows_only"
      ]
    },
    {
      "path": "/api/venues/operator/*",
      "methods": [
        "GET",
        "POST"
      ],
      "surface": "venue operator dashboard, submissions, moderation, lifecycle",
      "citizen_data": false,
      "operator_data": true,
      "controls": [
        "synthetic_operator_token_currently_required",
        "venue_scope_check",
        "operator_audit_event",
        "server_side_rbac_required_before_real_admin_launch"
      ]
    },
    {
      "path": "/api/venues/applications",
      "methods": [
        "POST"
      ],
      "surface": "venue application intake",
      "citizen_data": false,
      "host_private_contact": true,
      "controls": [
        "field_allowlist",
        "contact_hashing",
        "review_queue_only"
      ]
    },
    {
      "path": "/api/venues/host-submissions*",
      "methods": [
        "GET",
        "POST"
      ],
      "surface": "host listing submission and photo upload/read",
      "citizen_data": false,
      "host_private_contact": true,
      "controls": [
        "field_allowlist",
        "photo_id_path_scope",
        "review_queue_only"
      ]
    },
    {
      "path": "/api/venues/listing-requests",
      "methods": [
        "POST"
      ],
      "surface": "venue listing request intake",
      "citizen_data": false,
      "host_private_contact": true,
      "controls": [
        "field_allowlist",
        "review_queue_only"
      ]
    },
    {
      "path": "/api/events/host-submissions",
      "methods": [
        "GET",
        "POST"
      ],
      "surface": "hosted event self-service queue",
      "citizen_data": false,
      "host_private_contact": true,
      "controls": [
        "contact_hashing",
        "operator_review_queue",
        "no_direct_public_listing"
      ]
    },
    {
      "path": "/api/connectors/events/webhook",
      "methods": [
        "POST"
      ],
      "surface": "generic event connector webhook",
      "citizen_data": false,
      "controls": [
        "connector_signature_required",
        "disabled_fail_closed_without_live_flag"
      ]
    },
    {
      "path": "/api/connectors/eventbrite/webhook",
      "methods": [
        "POST"
      ],
      "surface": "Eventbrite connector webhook",
      "citizen_data": false,
      "controls": [
        "connector_signature_required",
        "disabled_fail_closed_without_live_flag"
      ]
    },
    {
      "path": "/api/stripe/webhook",
      "methods": [
        "GET",
        "POST"
      ],
      "surface": "Stripe webhook signature verification",
      "citizen_data": true,
      "payment_data": true,
      "requires_valid_signature": true,
      "controls": [
        "stripe_signature_required_for_post",
        "five_minute_timestamp_window",
        "test_and_live_webhook_secret_names_only",
        "no_live_charge_tests_without_written_approval"
      ]
    },
    {
      "path": "/api/account/*",
      "methods": [
        "GET",
        "POST"
      ],
      "surface": "private account profile, constellation, audit, settings, exit, nudges, invitations, DM",
      "citizen_data": true,
      "requires_authenticated_session": true,
      "controls": [
        "accountFromRequest_auth_guard",
        "rtbf_delete_cascade",
        "audit_export",
        "no_public_per_citizen_explanations"
      ]
    }
  ]
}