DM
All learning areas
Protect

Security Checklists

Practical checks for common application boundaries and sensitive workflows.

Topic library

AuthenticationAuthorizationAPI securityFile uploadsPaymentsWebhooksPassword storageSessions and cookiesSecrets managementDependency securitySensitive loggingSQL injectionXSS and CSRFSSRFRate limitingMulti-tenant isolationMobile application security

Featured guides

Practical starting points for the highest-value topics.

Authorization checklist

Verify permission at the server boundary for every protected action.

  1. Authenticate the caller using a verified, non-expired session or token.
  2. Load the target resource and verify tenant, ownership, role, and action.
  3. Apply the same rules to bulk, export, background, and administrative paths.
  4. Return minimal information when access is denied.
  5. Log sensitive administrative decisions without logging secrets.

Key idea: Knowing an object identifier never grants permission to use it.

File-upload checklist

Treat file contents, names, metadata, and delivery as untrusted.

  1. Require authorization and limit count, size, and rate.
  2. Generate server-side names and store outside executable web roots.
  3. Check actual file signatures, not only extensions or client MIME types.
  4. Scan when appropriate and process in an isolated environment.
  5. Serve with safe content headers and short-lived authorized URLs.

Key idea: Validation must cover storage and later delivery, not only upload.

Secrets checklist

Minimize exposure and make credential rotation routine.

  1. Keep secrets out of source control, images, browser bundles, and logs.
  2. Use a secret manager and grant workloads least-privilege access.
  3. Prefer short-lived workload identity over long-lived keys.
  4. Rotate credentials and support overlapping keys during transitions.
  5. Audit access and maintain a tested response for accidental disclosure.

Key idea: A secret without an owner and rotation path is future incident debt.