# Security Checklist — Foundation

- [x] Wallet amounts stored as integer minor units, not floating point.
- [x] Wallet update uses DB transaction + row lock.
- [x] Ledger uses unique idempotency keys.
- [x] Purchases have unique idempotency keys.
- [x] Unknown provider outcome becomes pending, not automatic refund.
- [x] Reversals create new compensating ledger entries.
- [x] Provider payload fields are encrypted at rest by Laravel casts.
- [x] Python is not allowed to directly mutate financial state.
- [ ] Add transaction PIN verification service.
- [ ] Add MFA/passkeys for privileged admin accounts.
- [ ] Add role/permission package or first-party permission layer.
- [ ] Add signed payment webhooks and replay protection.
- [ ] Add provider-specific signature validation.
- [ ] Add per-endpoint throttling.
- [ ] Add reconciliation scheduler and retry policy.
- [ ] Add admin action audit middleware.
- [ ] Add device/session management.
- [ ] Add tests for concurrency and idempotency.
- [ ] Add backup/restore runbook.
- [ ] Add secrets rotation.