Phase 10a: Pre-Launch Security Hardening

phase-mcd-tracker-10a-security Phase

phase

Project

Goal: Harden the stack against bot abuse, credential stuffing, and API spam before the App Store makes the app publicly discoverable.

Owner: Dev agent (API + Keycloak config) + Lucas (Keycloak admin console)

Repo: mcd-tracker-api, Keycloak admin console (manual)

Depends on: Phase 7 (app deployed), Phase 9 (iOS build working)

Keycloak CAPTCHA on registration — enable reCAPTCHA or hCaptcha on the mcd-tracker realm registration flow. Blocks automated account creation.
Keycloak brute force detection — enable in realm settings. Lock account after N failed login attempts. Configure permanent vs temporary lockout.
API rate limiting — add middleware to mcd-tracker-api. 60 req/min per authenticated user. 10 req/min for unauthenticated endpoints (healthz only). Use slowapi or custom middleware.
CORS audit — verify Access-Control-Allow-Origin is locked to mcd-tracker-app.tail5b443a.ts.net and capacitor://localhost. No wildcards.
XSS audit — grep all Svelte files for {@html} usage with user-supplied data. SvelteKit escapes by default but {@html} bypasses it.
Input validation — verify all API string inputs have max_length constraints (Pydantic). Prevent oversized payloads.
Keycloak password policy — set minimum length, complexity requirements on mcd-tracker realm.

plan-mcd-tracker — parent plan
phase-mcd-tracker-10-app-store — parent phase (security gates App Store submission)
sop-network-security — platform security SOP