Security is not a feature you add later. It is a foundation you build from day one. Here is our production checklist.
By David Friedman, Founder of AppBrewers
We have audited 20+ web apps for security. The same vulnerabilities appear repeatedly. Here is the checklist we use for every project.
Authentication
- [ ] Use OAuth 2.0 / OpenID Connect (Firebase Auth, Clerk, Auth0)
- [ ] Enforce strong passwords (8+ chars, complexity requirements)
- [ ] Implement brute-force protection (rate limiting)
- [ ] Use secure session tokens (HTTPOnly, SameSite, Secure flags)
- [ ] Add multi-factor authentication for admin roles
Authorization
- [ ] Verify permissions on every API endpoint (server-side)
- [ ] Use Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC)
- [ ] Never trust client-side permission checks
- [ ] Validate resource ownership (user A cannot access user B's data)
Data Protection
- [ ] Encrypt data at rest (AES-256)
- [ ] Encrypt data in transit (TLS 1.3 minimum)
- [ ] Hash passwords with bcrypt / Argon2 (never MD5 or SHA1)
- [ ] Mask sensitive data in logs
- [ ] Implement GDPR-compliant data deletion
Input Validation
- [ ] Validate all inputs server-side (never trust client)
- [ ] Sanitize HTML to prevent XSS
- [ ] Use parameterized queries (prevent SQL injection)
- [ ] Validate file uploads (type, size, content scan)
- [ ] Set strict Content Security Policy headers
Infrastructure
- [ ] Use HTTPS everywhere (HSTS enabled)
- [ ] Keep dependencies updated (automated scanning)
- [ ] Implement DDoS protection (Cloudflare, AWS Shield)
- [ ] Enable Web Application Firewall (WAF)
- [ ] Regular security audits and penetration testing
Monitoring
- [ ] Log all authentication attempts
- [ ] Alert on suspicious activity (impossible travel, brute force)
- [ ] Monitor for dependency vulnerabilities (Snyk, Dependabot)
- [ ] Incident response plan documented
Common Vulnerabilities We Fix
| Vulnerability | Impact | Fix |
|---|---|---|
| XSS | Session hijacking | CSP + input sanitization |
| CSRF | Unauthorized actions | SameSite cookies + tokens |
| SQL Injection | Database access | Parameterized queries |
| IDOR | Data leakage | Server-side authorization |
| Insecure Direct Object Reference | Account takeover | UUIDs + permission checks |
Need a Security Audit?
We build secure web apps from the ground up. Auth, encryption, compliance. Penetration testing available. Malta-based security team.
Originally published on the AppBrewers Blog.
Top comments (0)