Security

Training, reference and checklists — from why these patterns keep recurring to the exact items to tick off on a project.

  1. Security Best Practices

    The training deck: 14 repeat mistakes with before/after code, CWE/OWASP mapping, triage, shift-left and tooling.
  2. Security Checklists

    All 116 practices split into nine per-discipline checklists, each with detail and a worked example.
  3. Project Security Checklist

    The same 116 practices as a tickable checklist for one project, with progress tracking.

Where to start

If you want to… Go to
Understand why these bugs keep coming back, with real before/after code Security Best Practices
Look up one specific practice and a worked example Security Checklists
Audit a project end to end and track what's done Project Security Checklist
Triage findings from a QA or pentest report Severity framework
Run the scanners yourself Tools you can run today
Or go straight to the checklist for one area:
Sort out passwords, staging access and shared secrets Credentials & Environment
Review a cloud or server setup Infrastructure
Protect sensitive data, or keep one client's data away from another's Data Protection
Harden a backend or API Backend
Harden a frontend or website Frontend
Harden a React Native or native app App / Mobile
Set up merge and deploy gates CI/CD Governance
Build security checks into normal QA QA & Testing
Use AI assistants, agents or MCP servers safely AI Tools & MCP
Do a fast, high-severity pass over an AWS account AWS Quick Checklist

Last updated: September 2026 · Sources: Offspring — Security Best Practices.pptx, Security Best Practices Checklist.xlsx, AWS Quick Checklist.xlsx