Free checklist

Web App Security Review Checklist

BuildSellSecure · Print this page or save it as PDF (Ctrl/Cmd + P)

A defensive review checklist for modern web and AI applications. All testing should happen in local, authorized environments only. Each item maps to the system taught in Secure AI Web Apps (see the course).

Model and scope

• Assets inventory and a data-flow diagram exist.
• Trust boundaries are marked.
• A threat model exists, ranked by likelihood and impact.
• Authorization to test is documented.

Identity and access

• Passwords are hashed with a modern algorithm.
• Session cookies are HttpOnly, Secure, and SameSite.
• Every resource checks ownership or role (no broken object access).
• Multi-factor and safe recovery are considered.
• Auth endpoints are rate-limited.

Input, output, and APIs

• Inputs are validated server-side at every boundary.
• Queries are parameterized (no string-built SQL).
• Output is encoded and a Content-Security-Policy is set.
• Public endpoints are rate-limited.
• CORS and CSRF are configured correctly.

Data, secrets, and privacy

• Secrets live in a secret store and rotate.
• PII is minimised and has a defined retention.
• Data is encrypted in transit and at rest.
• File storage enforces access control.

Integrations

• Webhooks verify signatures and are idempotent.
• File uploads validate type, size, and content.
• Outbound requests are protected against SSRF.
• Third-party access is least-privilege.

Infrastructure

• Containers run as non-root with minimal images.
• The server uses key-only SSH, a firewall, and updates.
• Nginx sets security headers and restricts methods.
• TLS is strong and renews automatically.

AI features

• AI threat model covers prompts, data, tools, and outputs.
• Prompt-injection mitigations are documented.
• Sensitive data stays out of prompts and logs.
• Tool permissions are scoped; high-impact actions need a human.
• Model output is validated as untrusted.

Delivery and response

• Secret, dependency, and container scanning run in CI.
• Security gates block real issues with a triage process.
• Logs exclude PII; alerts are configured.
• Backups are tested with a restore.
• An incident runbook is written and rehearsed.