# Security Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "OWASP Top 10 coverage verified: each category has at least one test or documented N/A justification"
- "All SQL queries use parameterized statements — verified by grep for string concatenation in query construction"
- "Authentication tokens expire after 1 hour and refresh tokens after 30 days, verified by test"
- "All user input is validated at the API boundary before reaching business logic"

### Bad criteria — vague (no clear check)

- "Security review done"
- "No SQL injection"
- "Auth is secure"

