Skip to main content

Security checklist

The checklist every project fills in before launch and reviews every quarter. Copy it to the project repo as SECURITY-CHECKLIST.md.

People and accounts​

  • Every person uses SSO with MFA. No shared or default passwords anywhere.
  • Seed scripts never create users with known passwords.
  • Production access limited to named people.
  • Secrets only in the vault and the secret store; a secret scanner runs in CI.

API​

  • Ownership checked on every object by id. API security
  • Sign-in and code requests rate limited, with lockout.
  • Inputs validated with schemas; parameterised queries.
  • Internal routes blocked at the edge and keyed in the app.
  • API docs and development mode off in production.
  • Database user has least privilege; never a superuser.
  • Secrets redacted from logs, with a test.
  • Webhooks verified by signature on raw bytes.

Web​

  • CSP and security headers. Web security
  • Safe cookies and CSRF protection.
  • Proxy headers trusted only from our CDN.
  • Server-side URL fetchers allowlisted.
  • Dev, staging and admin panels not reachable from the open internet.

Mobile and desktop apps​

  • Attestation enforced in prod on every platform. Mobile app security
  • No secrets or bypass codes in the binary.
  • Every rule that matters enforced on the server.

Infrastructure​

  • CloudTrail, GuardDuty, access logs on. Infrastructure security
  • WAF in Block mode; load balancer default 404.
  • Databases and admin tools private; networks segmented.
  • Temporary access has an end date.

Process​

  • Weekly log review with saved queries.
  • An incident lead and a runbook. See Incidents.
  • After any incident: write it up in Attacks we faced.
Last updated on