web-security-checklistlisted

# Web Security Checklist A fast, concrete checklist for reviewing and hardening web applications. Read the relevant section for the change at hand rather than the whole file. Treat each unchecked box as a question to answer, not a box to tick blindly. ## Rationalizations (read first) Pre-written rebuttals to the excuses that precede a skipped control. If you catch yourself thinking the left column, the right column is the answer. | Rationalization | Rebuttal | |---|---| | "This endpoint is internal, no auth needed." | "Internal" is a network assumption, not a guarantee. Authn + authz still apply. | | "It's just an MVP, we'll harden later." | Auth, secrets, and injection are table stakes, not later-work. Later rarely comes. | | "Input comes from our own frontend." | The frontend is not a trust boundary. The API is. Validate at the boundary. | | "It's behind a login, so it's safe." | Authn ≠ authz. IDOR lives exactly here — check owner/role on every resource. | | "The framework auto-escapes output." | Verify the sink. `dangerouslySetInnerHTML`, raw SQL, and template bypasses exist. | ## Threat modeling (start here) Before picking defenses, spend five minutes thinking like an attacker: - [ ] Trust boundaries mapped (requests, file uploads, webhooks, third-party APIs, LLM output). - [ ] Sensitive assets identified (credentials, PII, payment data, admin actions, financial transactions). - [ ] STRIDE pass per boundary (Spoofing, Tampering, Repudiation, Information disclosure