Security Review (-link backend)

Follow AGENTS.md first. Backends are unauthenticated by design and reachable only through the router / reverse proxy — the router owns edge auth. "Read-only" is not "safe": returned text and tool descriptions are prompt-injection surfaces. Ground in ../genefoundry-router/docs/SECURITY-ASSESSMENT-2026-06-29.md and ../genefoundry-router/docs/CONTAINER-HARDENING-STANDARD-v1.md.

Checklist

1. No token passthrough — never forward the MCP caller's Authorization to upstreams; use the backend's own credential if any.
2. Upstream host is fixed — a config constant, never built from a tool argument (SSRF). If a user URL is ever fetched, gate it through a scheme + host allowlist that rejects private IPs and re-validates redirects (pubtator SafeUrlFetcher pattern).
3. No PII in logs — never log variant coordinates, phenotype text, or free-text queries (may be GDPR Art. 9 patient-derived); log correlation id + tool + timings only.
4. SQL / XML / tar safety — parameterized queries only; defusedxml; hardened archive extraction.
5. CORS — never allow_origins=* with allow_credentials=True.
6. Destructive / write tools — opt-in via an explicit env flag (default off); jail any file-writing path (reject abs / ..); cap unbounded list inputs.
7. Container — non-root, read-only rootfs, cap_drop: ALL, no-new-privileges, resource limits, digest-pinned base, ports: !reset [] expose-only, secrets runtime-only, Trivy gate + SBOM.
8. Prompt injection — treat retrieved text as evidence, not instructions; keep the research-use / not-CDS disclaimer.
9. Error-message sanitation — structured error fields are fixed/enum/validated; never reflect caller-supplied names/URIs or upstream 4xx/5xx bodies into caller-visible fields or logs (Response-Envelope v1.1 §Error-message sanitation; FastMCP not-found reflection guard).

Common mistakes

• Assuming a read-only server can't participate in exfiltration (lethal trifecta: private data + untrusted content + outbound channel).
• A ports: mapping in the base compose surviving overlay merge — ports: !reset [] is mandatory to drop it.
• Logging the request path/params "for debugging" — that can be PHI.