1. Scope

3. Review Checklist

Work through all seven categories. Each has a detailed reference file.

Category 1: Encryption

Full checks: references/encryption-checks.md

• All sensitive data uses AES-256-GCM via crypto-dek.ts — never inline crypto.createCipheriv()
• Two-layer key hierarchy: KEK wraps DEK. Account-level and line-level DEKs.
• AAD binds ciphertext to account_id + line_id + type
• Health data uses line DEK only — no account DEK fallback
• import 'server-only' on all files in src/lib/ultaura/
• Fresh random 12-byte IV per encryption call

Category 2: RLS (Row-Level Security)

Full checks: references/rls-checks.md

• Every new table: ALTER TABLE ... ENABLE ROW LEVEL SECURITY
• At least one RLS policy scoped to account ownership
• Policies use (select auth.uid()) not bare auth.uid() (Supabase lint 0003)
• All SECURITY DEFINER functions have SET search_path = public
• Use helpers is_ultaura_account_owner() and can_access_ultaura_health_line()
• Health tables have enforce_health_account_line_consistency() trigger

Category 3: API Authentication

Full checks: references/api-auth-checks.md

• Browser routes: supabase.auth.getUser() first (not getSession())
• Application-level ownership: created_by_user_id === userId
• Internal/telephony routes: validateWebhookSecret() with crypto.timingSafeEqual
• Admin routes: JWT app_metadata.role === 'super-admin'
• Server-side only: getSupabaseRouteHandlerClient() from src/lib/server/

Category 4: Input Validation

Full checks: references/input-validation-checks.md

• File uploads: MIME allowlist + extension match + magic bytes + size cap + rate limit
• UUID params: validate with /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
• Secret/token comparisons: crypto.timingSafeEqual (not ===)
• AI-generated content: sanitizeSummaryParaphrase() from src/lib/ultaura/health/sanitize.ts
• No dangerouslySetInnerHTML without sanitization

Category 5: Privacy

Full checks: references/privacy-checks.md

• Sensitive routes return 404 (not 403) to prevent existence disclosure
• Document tokens: 5-minute TTL, single-use, stored as SHA-256 hash, 30/hour rate limit
• Privacy export: owner-only access, generic error messages
• Redirect URLs validated as https: before issuing
• No PII in error messages, logs, or client-side state

Category 6: Consent

Full checks: references/consent-checks.md

• Health data only flows when health_consent === 'granted'
• requireHealthLineAccess() and requireHealthOwner() are the central gates
• Every consent mutation writes audit entry to ultaura_health_consent_history (encrypted)
• Re-prompt cooldown: 30 days for family-managed accounts
• Entitlement gate: feature flag (fail-closed) + plan eligibility check
• Health data excluded from sharing gate — uses its own consent mechanism

Category 7: Database Migration

Full checks: references/db-migration-checks.md

• Naming: YYYYMMDDHHMMSS_snake_case_description.sql
• Every new table: ENABLE ROW LEVEL SECURITY + at least one policy
• Sensitive columns: encrypted_data + encrypted_data_key (or health-specific payload columns)
• Migrations are idempotent (IF NOT EXISTS) and have a safe rollback path
• No destructive operations without explicit user confirmation
• SET search_path = public on all SECURITY DEFINER functions

4. Output Format

## Security Review: [area/file(s) reviewed]

### Findings

| # | Severity | Category | Finding | File:Line | Recommendation |
|---|----------|----------|---------|-----------|----------------|
| 1 | CRITICAL | Encryption | Inline crypto.createCipheriv() instead of using crypto-dek.ts | src/lib/foo.ts:42 | Use encryptPayload() from crypto-dek.ts |
| 2 | HIGH | RLS | New table missing RLS policy | migrations/20260317_foo.sql:15 | Add owner-scoped SELECT policy |
| 3 | MEDIUM | API Auth | Using getSession() instead of getUser() | src/app/api/foo/route.ts:8 | Switch to getUser() for server-side verification |
| 4 | LOW | Input | Missing length cap on user-provided string | src/app/api/foo/route.ts:25 | Add maxLength validation |

### Severity Definitions

- **CRITICAL**: Exploitable now — data exposure, auth bypass, or encryption failure. Must fix before merge.
- **HIGH**: Likely exploitable under specific conditions — missing RLS, weak auth, timing attack vector. Must fix before merge.
- **MEDIUM**: Defense-in-depth gap — not directly exploitable but weakens security posture. Should fix.
- **LOW**: Best practice deviation — minimal immediate risk but worth addressing. Consider fixing.

### Summary

- **Total findings**: N
- **Critical**: N | **High**: N | **Medium**: N | **Low**: N
- **Recommendation**: PASS / PASS WITH CONDITIONS / FAIL

PASS = No Critical or High findings
PASS WITH CONDITIONS = No Critical, but High findings exist with documented mitigation plan
FAIL = Any Critical finding, or 3+ unmitigated High findings

5. OWASP Top 10 Mapping

6. SOC 2 Controls Mapping

7. HIPAA Considerations

Ultaura handles health-related data for seniors. Even if not yet a HIPAA covered entity, these controls align with HIPAA requirements: