newspaper_wedding/aidlc/spaces/default/intents/260913-newspaper-gen/construction/build-and-test/security-test-instructions.md

Security Test Instructions — Wedding Newspaper Generator

Per NFR9 (strict isolation): the emitted page is zero-network; no secrets are committed or transmitted; the only sanctioned external call is the ai-draft cloud model.

How to run

1. Confirm no http(s)/remote refs leak into the emitted page (the tests assert is_self_contained() / no-http in generator HTML).
2. Confirm config.json (masthead) and any model endpoint are user-supplied, not committed secrets: grep the repo for obvious credential patterns.

   grep -rniE "(api[_-]?key|secret|token|password|authorization)\s*[:=]\s*['\"][A-Za-z0-9]" newspaper --include="*.py" --exclude="*.pyc" || echo "no obvious secrets"
   

3. Confirm no fabricated images when photos absent (FR7.4) — covered by tests.