Pilot participant nyata → kontrol keamanan/privasi di bawah ini adalah wajib. Baseline: PRD §9.

• Secrets fail closed di produksi — src/config.ts melempar error saat startup jika env yang dibutuhkan hilang/invalid di production (PRD §9).
• Tidak ada secrets di logs — error handler hanya mencatat code + status + requestId, bukan payload sensitif (PRD §9: consent answers, screening payloads, EMA notes, safety notes, access tokens dilarang di logs).
• Error generik anti-enumeration — pesan error aman untuk user; detail internal tidak dibocorkan ke client.
• TLS only di luar development lokal.
• .env / .dev.vars tidak pernah di-commit (.gitignore); contoh placeholder ada di .env.example / .dev.vars.example.
• Auth JWT (M1) — bearer token diverifikasi (HS256, Supabase-compatible) via jose; role aplikasi + membership di-resolve dari server; path publik eksplisit (/v1/config/public) tanpa data sensitif.
• Verified email — accept invitation wajib email terverifikasi (assertVerifiedEmail).
• RLS deny-by-default — seluruh tabel enable row level security; hanya policy select own untuk participant; researcher tables tanpa policy authenticated (semua akses lewat backend service role + authorization eksplisit, PRD §8). Mobile tidak pernah menerima service-role key.
• Audit events append-only — protocol/team/safety operations menulis audit_events via RPC; safety_transitions append-only.
• No hard-delete — withdraw/data lifecycle memakai status, bukan delete (records tetap ada, PRD §5.7); invitation single-use + hash token (token_hash sha256, plaintext tidak disimpan).
• CSV injection guard — export CSV disanitasi terhadap formula injection (=, +, -, @, tab, CR/LF).
• Rate limits — src/shared/rate-limit/ (D-018): sliding-window in-memory per-isolate pada auth-adjacent/registration/safety/export endpoints; 429 memakai envelope PRD §7 + Retry-After. Catatan: state per-isolate (bukan global antar-isolate) — evaluasi migrasi ke binding native/Durable Objects bila naik Workers Paid.
• CI guards — dependency scan (pnpm audit --prod), secret scan (gitleaks, license-free), migration + openapi drift checks (PRD §9, §12).

• Access tokens hanya disimpan di OS secure storage (client mobile) — tanggung jawab aplikasi mobile.
• Backup/restore: prosedur lengkap di docs/runbook.md + scripts/backup-db.sh (D-019) — dokumentasi ✅; rehearsal restore sungguhan & nilai jadwal/retensi/ lokasi backup (PRD §14) masih pending (item C7 launch-blockers).
• Key rotation terjadwal (JWT secret) — butuh infrastruktur/ops riil.

Temukan kerentanan? Jangan publikasikan sebelum ditangani. Hubungi maintainer (lihat CONTRIBUTING.md) dengan deskripsi dampak dan langkah reproduksi — tanpa menyertakan data participant nyata.

Privacy notice, consent content, screening instrument, support contacts, monitoring hours, data controller, incident owner, retention/deletion schedule — wajib disuplai tim studi & etik sebelum akses participant nyata. Agent implementasi tidak boleh mengarang nilai-nilai ini.