VERIFICATION CHECKLIST: Authentication Module

→ SECURITY VERIFICATION (DO THIS FIRST)
  ✓ Password hashing: bcrypt or argon2? (if MD5 or SHA1, FAIL)
  ✓ Salt unique per hash? (check db – not stored plaintext)
  ✓ Timing attack vulnerability? (use constant-time comparison)
  ✓ Session token generation: cryptographically secure? (not Math.random())
  ✓ Token storage: httpOnly cookie + secure flag set?
  ✗ TRAP: Many auth breaches from session fixation – always regenerate token on login

→ EDGE CASE COVERAGE
  ✓ Test concurrent login attempts (same user, 2 browsers)
  ✓ Test token expiration (attempt use at expiry+1ms)
  ✓ Test password reset flow (invalid token after use, expiry honored)
  ✓ Test logout across all sessions (one logout doesn't kill others)
  ✓ Test admin escalation (user can't self-promote to admin)
  Question to resolve: LDAP fallback – scope of directory users included?

→ COMPLIANCE & AUDIT
  ✓ Confirm password policy (min 8 chars, no common patterns)
  ✓ Failed attempt logging (locked after 5 tries / 15min window)
  ✓ No credentials in logs (grep for password variables in output)
  ✓ PII properly scoped in error messages (user doesn't see system internals)

→ DEPLOYMENT GATE
  Stop: Run full integration test suite before ship (required pass rate: 100%)
  Stop: Security scan on dependencies (run npm audit / pip audit)
  Action: Coordinate staged rollout – 10% traffic first (1 hour), then 50%, then 100%