GetReal Consent Form - Security Audit Checklist

Document Version: 1.0 Last Updated: 2025-11-07 Prepared By: Testing & Documentation Agent Purpose: Pre-deployment security and quality assurance checklist

đź“‹ How to Use This Checklist

  1. Pre-Deployment: Run through ALL sections before deploying to production
  2. Testing Environment: Perform tests on staging/local first
  3. Sign-Off Required: Every checkbox must be verified before production deploy
  4. Documentation: Record findings in audit log (create audit-log-YYYY-MM-DD.md)

1. Environment Configuration

Production Environment Variables

2. Security Controls

Input Validation

Rate Limiting

// Run in browser console on /getreal/consent page
async function testRateLimit() {
  for (let i = 1; i <= 6; i++) {
    const response = await fetch('/api/create-submitter', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        template_id: 1228886,
        prolific_pid: `test-${Date.now()}`,
      }),
    });
    console.log(`Attempt ${i}:`, response.status, await response.text());
    await new Promise((r) => setTimeout(r, 1000)); // 1s delay
  }
}
testRateLimit();

Network Security

3. Error Handling

Network Errors

Backend Error Responses

Duplicate Submission Prevention

4. Privacy & Data Protection

PII Handling

GDPR Compliance

5. Accessibility (WCAG 2.1 AA)

ARIA & Semantic HTML

Color Contrast

6. Performance

Memory Leaks

Network Performance

7. UX Testing

Scroll Tracking

Completion Reminder

Form Submission Flow

Redirect After Completion

Retry Button

8. Browser Compatibility

Desktop Browsers

Mobile Browsers

Compatibility Issues

9. Integration Testing

DocuSeal Embedding

Backend API Integration

Email Pre-fill (Recruitee)

PID Parameter (Prolific)

10. Production Readiness

Code Quality

Performance Metrics

Error Tracking

Analytics

11. Security Headers (Backend)

Note: These are backend responsibilities, verify with backend team.

12. Documentation

13. Deployment Checklist

Pre-Deployment

Deployment

Post-Deployment

14. Rollback Plan

Trigger Conditions

Rollback Steps

  1. Notify stakeholders (Slack #engineering)
  2. Revert to previous deployment
  3. Verify old version is working
  4. Post-mortem analysis within 48 hours

15. Sign-Off

Testing Team

Product Team

Engineering Team

Deployment Approval

Appendix: Testing Scripts

Rate Limit Test Script

// Run in browser console on /getreal/consent page
async function testRateLimit() {
  const pid = `test-${Date.now()}`;
  for (let i = 1; i <= 6; i++) {
    const response = await fetch('https://api.yourpersonalai.net/create-submitter', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        template_id: 1228886,
        prolific_pid: pid,
        source: 'Prolific',
        completed_redirect_url: '/getreal/video-redirect',
      }),
    });
    const data = await response.json();
    console.log(`Attempt ${i}:`, response.status, data);
    await new Promise((r) => setTimeout(r, 1000)); // 1s delay
  }
}
testRateLimit();

XSS Test Payloads

// Test in browser console
const xssPayloads = [
  '<script>alert("XSS")</script>',
  '<img src=x onerror=alert(1)>',
  'javascript:alert(1)',
  '<svg/onload=alert(1)>',
  '"><script>alert(1)</script>',
];

xssPayloads.forEach((payload) => {
  const url = `/getreal/consent?prolific_pid=${encodeURIComponent(payload)}`;
  console.log('Testing XSS:', url);
  // Open in new tab and verify error message shown (payload not executed)
});

SQL Injection Test Payloads

const sqlPayloads = ["'; DROP TABLE users; --", "1' OR '1'='1", "admin'--"];

sqlPayloads.forEach((payload) => {
  const url = `/getreal/consent?prolific_pid=${encodeURIComponent(payload)}`;
  console.log('Testing SQL injection:', url);
  // Verify payload rejected by validation
});

End of Checklist

Revision History

VersionDateAuthorChanges
1.02025-11-07Testing AgentInitial checklist created