Modelo pronto: carta de autorização para auditoria de segurança (escopo + regras de engajamento)

Security audits require a formal written authorization document to define the scope and engagement rules, ensuring clients take the process seriously. For passive web configuration audits, this document must specify assets, dates, and limits, prohibiting fuzzing or brute force. Additionally, auditors verify HTTP security headers to prevent vulnerabilities. Recommended headers include Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy, which protect against XSS, clickjacking, and MIME sniffing across Nginx or Apache servers.