Checklist progress is saved in this browser on this device.
Use this as a project review aid with the application owner and technical team. It is based on the risk areas in the OWASP Application Security Verification Standard and OWASP Top 10. It does not replace a threat model, specialist review, or testing suited to the application's risk.
Scope and ownership
- Name the application owner, security contact, and incident decision maker.
- Draw the system boundary and list user types, services, APIs, data stores, and third parties.
- Identify sensitive data, its purpose, source, destination, retention period, and deletion path.
- Write down the most important abuse cases and the harm they could cause.
- Agree on risk tolerance, required assurance, and who accepts remaining risk.
Identity and access
- Require authentication where the data or action needs it.
- Enforce authorization on the server for every protected object and action.
- Check role changes, account recovery, session expiration, and logout behavior.
- Store secrets in a managed secret store; keep them out of source code and logs.
- Use least privilege for users, service accounts, deployment tokens, and database roles.
- Rate limit sensitive flows such as sign-in, password reset, and account creation.
Input, output, and data protection
- Validate inputs against expected types, lengths, ranges, and business rules.
- Encode output for its context and use parameterized database queries.
- Protect state-changing requests against cross-site request forgery where applicable.
- Set secure transport, cookie, content security, and browser security policies.
- Encrypt sensitive data in transit and at rest, with key ownership documented.
- Exclude passwords, tokens, and unnecessary personal data from telemetry and logs.
Dependencies and release
- Inventory production dependencies and assign an owner to update them.
- Review dependency alerts and remove packages that are no longer needed.
- Scan code and build artifacts for known vulnerabilities and exposed secrets.
- Separate development, preview, and production credentials and data.
- Verify backups, rollback steps, security contact paths, and incident procedures.
- Record findings, owners, due dates, and accepted exceptions.
References
Every business and project is different. Treat this as general planning guidance, then confirm platform-specific, legal, tax, and security requirements with the appropriate provider or qualified professional.