A practical security checklist

In plain English

Authentication is how a system proves who you are, such as a password plus MFA, while authorization is what that identity is allowed to do once logged in, and both need checking separately. Input is anything a user or another system sends you, and it must be treated as untrusted and handled with parameterised queries and output encoding. Secrets are credentials like API keys and database passwords that belong in a secret manager rather than in Git, client code or logs. Headers are instructions your server sends the browser, such as HTTPS, HSTS and Content Security Policy, that close whole classes of web attacks. Dependencies, monitoring and backups round out the list, because the code you did not write, the errors you cannot see and the data you cannot restore are where most failures begin.

Step by step

1. 1Walk through each route and confirm authentication and authorization checks.
2. 2Trace one request from input to output and confirm nothing untrusted becomes code.
3. 3Search the repository and logs for hardcoded or leaked secrets.
4. 4Review headers, lockfile and audit status, and confirm monitoring and backups run.
5. 5Fix anything that fails before shipping, then re-run the checklist.

Authentication: slow password hashing, MFA, rate limiting
Authorization: least privilege, server-side checks
Input: parameterised queries, output encoding
Secrets: secret manager, nothing in Git or logs
Headers: HTTPS, HSTS, CSP, secure cookies
Dependencies: lockfile, audit, pinning
Monitoring: structured logs, few precise alerts
Backups: 3-2-1, immutable copy, restore drills

Common mistakes

• Checking authentication but not authorization lets a logged-in user perform actions they should not be allowed to do.
• Validating input at the front end but not on the server trusts an attacker to obey the browser.
• Committing a secret and later deleting the file still leaves it in Git history, where it stays readable.
• Treating the checklist as a one-time task misses that every new feature can reopen an old hole.