Security Review Checklist
A practical, risk-based security review checklist for developers and code reviewers to systematically catch vulnerabilities during software development.
1. Authentication & Session Security
Verify identity verification, session management, and token lifetime security.
2. Authorization & Tenant Boundaries (BOLA / IDOR)
Prevent unauthorized access across users, roles, and multi-tenant boundaries.
3. Input Validation & Data Boundaries
Enforce strict schema validation and boundary limits on all incoming request data.
4. Injection Attack Prevention
Eliminate SQL, command, template, and query language injection vulnerabilities.
5. Output Escaping & Browser Security (XSS / CORS / CSP)
Protect client-side rendering against XSS, open redirects, and origin exploits.
6. Sensitive Data Handling & Leak Prevention
Protect passwords, PII, payment data, and sensitive client state from exposure.
7. Secrets Management & Repository Hygiene
Prevent hardcoded API keys, tokens, and credentials from entering source code.
8. API Security & Rate Limiting
Safeguard APIs against resource exhaustion, mass assignment, and data over-exposure.
9. File Uploads & Path Safety
Prevent malicious file execution, path traversal, and storage exhaustion.
10. Dependency & Supply Chain Security
Audit third-party libraries for vulnerabilities, typosquatting, and supply chain risks.
11. Cryptography & Key Management
Avoid custom cryptographic implementations and obsolete algorithms.
12. Error Handling & Information Disclosure
Prevent stack traces and internal debugging information from leaking to clients.
13. Security Telemetry & Event Logging
Ensure security events are logged for auditability without logging sensitive secrets.
14. Business Logic & Workflow Flaws
Guard against step bypassing, race conditions, and parameter manipulation in business workflows.
15. Infrastructure & Configuration Hardening
Audit security headers, storage access policies, and environment configurations.
Developer Security Review Boundary Notice
This checklist is designed as a practical first-pass tool for software developers and code reviewers to catch common vulnerabilities during pull request reviews. Completing this checklist does not prove an application is 100% secure. It is not a replacement for formal threat modeling, automated SAST/DAST security scanning, or professional third-party penetration testing.
6 Essential Questions Every Code Reviewer Must Ask
Before approving code changes, shift your perspective from "Does this code work for valid users?" to "How could a malicious user tamper with these requests?"
1What can the user control in this request?
Identify all user-controlled inputs: URL parameters, query strings, headers, cookies, file names, and JSON body fields. Never trust values without server-side validation.
2What happens if they swap resource identifiers?
If an endpoint takes an ID (e.g. /api/orders/9921), test if replacing it with another user's ID leaks or mutates data (IDOR / BOLA vulnerability).
3What if they call endpoints out of workflow order?
Can an attacker bypass Step 2 (payment verification or MFA challenge) and call Step 3 directly? Ensure backend controllers validate multi-step state machine transitions.
4What if they repeat the request in parallel?
Sending 10 concurrent requests to a single-use coupon or checkout endpoint can exploit race conditions to redeem rewards multiple times before DB locks update.
5What data should this user NOT be able to see?
Check if API responses return full database objects (including password hashes, internal flags, or PII) relying on the frontend to filter displayed fields.
6What is trusted only because the frontend enforces it?
Disabling a button or hiding a form in React does NOT stop cURL or Postman. All validation and authorization must be re-enforced on the backend server.
Top 5 Security Vulnerability Patterns & Prevention
Focus your code review effort on these five high-frequency vulnerability classes:
Fetching resources by ID without checking if the ID belongs to the authenticated user or tenant.
// Bad: findOne({ id: req.params.id })
// Good: findOne({ id: req.params.id, tenantId: user.tenantId })Accidentally committing API keys, private certificates, or DB credentials to source repositories or public frontend bundles.
// Bad: const KEY = "sk_live_99a..."
// Good: const KEY = process.env.STRIPE_SECRET_KEYInjecting un-sanitized user strings into DOM sinks, executing arbitrary JavaScript in user browsers.
// Bad: dangerouslySetInnerHTML={{ __html: input }}
// Good: DOMPurify.sanitize(input)When to Use This Checklist
- Before approving pull requests that modify auth, permissions, data queries, or external APIs.
- When adding new third-party npm/pip dependencies or updating crypto/token handling.
- During feature design reviews to audit authorization checks, tenant boundaries, and rate limits.
- When exposing new public endpoints, file upload handlers, or webhook callbacks.
Common Pitfalls to Avoid
- Relying on frontend validation or UI hiding for authorization instead of enforcing permission checks in backend controllers.
- Checking user roles (is_admin) but failing to verify resource tenant ownership (WHERE user_id = current_user.id), leading to IDOR bugs.
- Committing API keys, DB credentials, or JWT signing secrets directly into git repositories or client-side bundles.
- Using raw string concatenation for SQL queries or shell commands instead of parameterized APIs.
- Assuming 100% checklist completion equals full application security — a checklist is a baseline audit tool, not a penetration test.
Connected Workflows & Tools
Complementary prompts, agent skills, and interactive tools in SprintKit.
Code Review Checklist
Peer review guide covering correctness, architecture, performance, and maintainability.
API Release Checklist
Ensure contract stability, rate limiting, and zero breaking changes when shipping APIs.
Database Migration Checklist
Plan, backfill, and safely execute production database schema changes.
Production Deployment Checklist
Pre-flight checks and live telemetry verification for shipping services.