Pre-launch security checklist

Use this as a lightweight gate before a new service goes to production, or as a self-review checklist ahead of a design/code review.

Access & authentication

• Authentication goes through the standard identity provider, not a custom scheme
• Admin/privileged accounts require MFA
• Sessions expire and can be revoked server-side

Data handling

• All external input is validated at the boundary
• Output is encoded/escaped for the context it’s rendered in (HTML, SQL, shell, etc.)
• Sensitive data is encrypted in transit (TLS) and at rest

Secrets

• No secrets in source code, git history, or CI logs
• Secrets are stored in the standard secrets manager / CI secrets store
• Secret scanning is enabled on the repository

Dependencies

• Automated dependency updates are enabled (Dependabot/Renovate)
• Vulnerability scanning runs in CI and blocks on high/critical findings
• Lockfile is committed and CI installs from it exactly (npm ci or equivalent)

Operations

• Changes go through pull request review and CI before deploying
• The service emits logs sufficient to investigate an incident
• There’s a clear owner/on-call for the service

See the Golden Path and Coding Guidelines for the reasoning behind each item.