az repos create --name surf-invoicing --project NGauge_Modules --organization https://dev.azure.com/PortalPeopleUK/# Compatibility & Security TODOs

## P0 - Immediate
- [ ] Rotate/revoke exposed credentials found in:
  - `backend/controllers/SendgridController.php`
  - `console/controllers/SendgridController.php`
  - `common/components/MSGraph.php`
  - `common/components/Netsuite/NSconfig.php`
  - `modules/NetSuite/components/NetSuiteApiAuth.php`
- [ ] Replace hardcoded secret values with env/secure config references.
- [ ] Remove token/refresh-token echo statements in `common/components/Sage.php`.
- [ ] Set Composer audit to fail on insecure packages in `composer.json` (`config.audit.block-insecure = true`).
- [ ] Review and justify/remove advisory ignore list in `composer.json`.

## P1 - Near Term
- [ ] Synchronize lock with manifest under PHP 8.5:
  - run `composer update --lock`
  - run `composer validate --no-check-publish`
  - run `composer check-platform-reqs`
- [ ] Replace unbounded `"*"` dependency constraints with semver ranges in `composer.json`.
- [ ] Review `enableCsrfValidation = false` usages and scope to only required webhook endpoints:
  - `backend/controllers/CartController.php`
  - `backend/controllers/SendgridController.php`
  - `backend/controllers/SlidesController.php`
  - `console/controllers/SendgridController.php`
- [ ] Refactor Ecwid calls in `common/models/Ecwid.php` to avoid token-in-query-string where possible.
- [ ] Ensure debug bootstrap is environment-gated in `backend/config/main.php`.

## P2 - Hardening
- [ ] Add secret scanning in CI and pre-commit.
- [ ] Add CI gates for `composer audit` and manifest/lock consistency.
- [ ] Define monthly dependency update process with owner.
- [ ] Create integration security checklist (token lifecycle, logging, error handling, transport, retries).

## Tracking Notes
- Owner:
- Target completion date:
- Risk sign-off:
