{
  "context": "Tests whether the agent registers @fastify/cors with an explicit origin allowlist (not a wildcard) with credentials enabled, and registers @fastify/helmet with HSTS, CSP, and frame-protection configured.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "@fastify/cors registered",
      "description": "The code imports from '@fastify/cors' and calls app.register(cors, ...) with a configuration object",
      "max_score": 10
    },
    {
      "name": "No wildcard CORS origin",
      "description": "The CORS origin option is NOT set to the string '*' or boolean true — it is an array of URLs, a function, or a RegExp-based allowlist",
      "max_score": 15
    },
    {
      "name": "CORS credentials enabled",
      "description": "The CORS configuration includes `credentials: true`",
      "max_score": 8
    },
    {
      "name": "CORS maxAge configured",
      "description": "The CORS configuration includes a numeric `maxAge` value (pre-flight cache duration in seconds)",
      "max_score": 5
    },
    {
      "name": "@fastify/helmet registered",
      "description": "The code imports from '@fastify/helmet' and calls app.register(helmet, ...) with a configuration object",
      "max_score": 15
    },
    {
      "name": "HSTS configured",
      "description": "The helmet config includes a `hsts` key with at least a numeric `maxAge` property",
      "max_score": 12
    },
    {
      "name": "Content-Security-Policy configured",
      "description": "The helmet config includes a `contentSecurityPolicy` key with a `directives` object containing at least a `defaultSrc` entry",
      "max_score": 12
    },
    {
      "name": "Frame protection configured",
      "description": "The helmet config includes a `frameguard` key with an `action` property set to 'deny' or 'sameorigin'",
      "max_score": 8
    },
    {
      "name": "Security documented",
      "description": "A file named architecture-notes.md (or security-notes.md) exists and describes at minimum which CORS origins are allowed and what the HSTS policy is",
      "max_score": 10
    },
    {
      "name": "No manual security headers",
      "description": "The code does NOT manually set X-Frame-Options, X-Content-Type-Options, or Strict-Transport-Security headers via reply.header() — relies on @fastify/helmet instead",
      "max_score": 5
    }
  ]
}