# Security Test Instructions — Wedding Newspaper Generator

Per NFR9 (strict isolation): the emitted page is zero-network; no secrets are
committed or transmitted; the only sanctioned external call is the ai-draft
cloud model.

## How to run
1. Confirm no `http(s)`/remote refs leak into the emitted page (the tests assert
   `is_self_contained()` / no-`http` in generator HTML).
2. Confirm `config.json` (masthead) and any model endpoint are user-supplied,
   not committed secrets: grep the repo for obvious credential patterns.
   ```bash
   grep -rniE "(api[_-]?key|secret|token|password|authorization)\s*[:=]\s*['\"][A-Za-z0-9]" newspaper --include="*.py" --exclude="*.pyc" || echo "no obvious secrets"
   ```
3. Confirm no fabricated images when photos absent (FR7.4) — covered by tests.