Security Checklists

116 practices across nine categories, researched from OWASP, AWS Well-Architected, MASVS and current AI-agent/MCP security guidance — each with detail and a concrete example. Plus a short quick pass for AWS accounts.

  1. Credentials & Environment

    13 practices · Passwords, staging access, secrets and who can reach what.
  2. Infrastructure

    18 practices · Identity, network boundaries, encryption, logging and recovery.
  3. Data Protection

    8 practices · Sensitive data separation, encryption, inventory and backups.
  4. Backend

    19 practices · Auth, authorization, input handling, logging and critical write paths.
  5. Frontend

    15 practices · Headers, cookies, sanitization — and never trusting the client.
  6. App / Mobile

    18 practices · Binary contents, token storage, transport and release-build hygiene.
  7. CI/CD Governance

    2 practices · Who can merge, and who can deploy to production.
  8. QA & Testing

    12 practices · Security checks as part of normal QA, not a separate pass.
  9. AI Tools & MCP

    11 practices · AI assistants, agents and MCP servers with least privilege.
  10. AWS Quick Checklist

    21 items · A fast IAM and security-group pass for any AWS account, ordered by severity.

All checklists

Checklist Items Source
Credential & Environment Hygiene 13 Internal team guidelines + OWASP Secrets Management & Authentication Cheat Sheets
Cloud & Infrastructure 18 AWS Well-Architected Security Pillar + general infra hardening
Data Protection & Tenant Isolation 8 General data protection guidance + multi-tenant SaaS security practices
Backend & API 19 OWASP Cheat Sheet Series (Authentication, Authorization, REST, Injection Prevention)
Frontend & Web 15 OWASP Cheat Sheets + current frontend security guidance
Mobile App 18 OWASP MASVS — Storage, Crypto, Auth, Network, Platform, Code, Resilience, Privacy
CI/CD Governance 2 CI/CD governance guidance + release-engineering best practices
QA & Testing Process 12 Industry QA/testing practice guidance + shift-left testing principles
AI Tools & MCP Security 11 Current AI-agent & Model Context Protocol (MCP) security guidance
AWS Quick Checklist 21 AWS Quick Checklist.xlsx (Template sheet)
Total 116 + 21  

The nine categories are the 116 practices from the best-practices deck. The AWS pass is a separate 21-item checklist for a single cloud account, so its items are counted apart rather than added in — several of them restate Infrastructure practices in AWS-specific terms.

Related

If you want to… Go to
Audit one project end to end and track what's done Project Security Checklist
Understand why these bugs keep coming back, with before/after code Security Best Practices
Triage findings from a QA or pentest report Severity framework

Last updated: September 2026 · Sources: Offspring — Security Best Practices.pptx (Part 4), Security Best Practices Checklist.xlsx, AWS Quick Checklist.xlsx