Identity and authorization
Define authentication flows, session lifecycle, role boundaries, tenant context and privileged actions. Test authorization server-side for every sensitive operation.
Do not rely on hidden buttons or client-side checks as security boundaries.
Data and secrets
Classify sensitive data, minimize collection, encrypt in transit and at rest where appropriate, and keep secrets out of client bundles and repositories.
Define retention, deletion and backup behavior so data governance is operational rather than theoretical.
API and dependency controls
Validate inputs, rate-limit abuse-prone endpoints, use least-privilege credentials and monitor third-party dependency risk.
External services should fail safely and should not receive broader access than required.
Logging without leaking data
Security events need auditability, but logs should not become a second copy of credentials, personal data or tokens.
Define structured security events and redaction rules before incidents happen.
Release and incident readiness
Automate dependency checks, permission tests and critical regressions. Maintain rollback, alerting and ownership for security incidents.
A secure product is one that can detect and recover, not one that assumes prevention will always succeed.
Turn the checklist into release gates
A checklist is useful only when critical items become repeatable controls. Automate dependency scanning, authorization tests, secret detection and security regressions where possible, and make high-risk failures block release rather than becoming optional review notes.
Keep a small set of security signals visible after launch as well: unusual authentication failures, privileged actions, rate-limit events, dependency alerts and data-access anomalies. Product security continues in operations.