Skip to main content
OpsRoadmaps

Checklists / security-review

Security Review Checklist

The control review that catches what pentests find later: authz, secrets, dependencies, data, and audit trails.

10 steps · 10 required · last reviewed (next review 2027-03-19) · updated 2026-09-21

Related focus areas:ComplianceOpsDevSecOpsSecOps

Roadmaps covering the same ground:AWS Security ImprovementDevSecOps RolloutProduction-Ready Kubernetes

Sign in to run this checklist

Run this against any new service or significant change before it takes production data. It is a controls review, not a compliance exercise: each item is a class of real incident.

Priorities if you cannot do everything: authorization, secrets handling, and dependency hygiene prevent the three most common breach patterns in small-company postmortems.

  1. Authorization is enforced server-side on every endpoint (deny by default)

    required

    Client-side checks are UX; the server-side default decides whether IDOR is a class of bug you have.

  2. Authentication uses vetted primitives (managed OAuth/OIDC), no hand-rolled crypto or password storage

    required

    Getting authentication right is solved; getting it wrong once is a breach with legal dimensions.

  3. Secrets live in a secret manager; none in code, config files, or CI logs

    required

    Secrets in git/CI are the most common leak vector — and git history makes them permanent.

  4. Dependency vulnerabilities are scanned in CI and triaged on a deadline

    required

    You do not get breached by exotic 0-days; you get breached by a 2-year-old CVE in a library nobody updated.

  5. Input validation happens server-side at the trust boundary (incl. file uploads)

    required

    Every field from outside is hostile until validated; uploads additionally need type/magic-byte checks and isolated serving.

  6. Sensitive data is encrypted in transit and at rest; PII inventory is known

    required

    You cannot protect what you have not inventoried — and the inventory is the first thing auditors and attackers both look for.

  7. Least-privilege access: service accounts scoped, no shared admin accounts, MFA on everything human

    required

    The blast radius of a stolen credential equals the privilege it carries; shared admin means unattributable actions.

  8. Audit logging records security-relevant events (auth, authz failures, admin actions) with integrity

    required

    Without an append-only trail, detection is late and forensics are impossible.

  9. Rate limiting and abuse controls exist on public endpoints

    required

    Unthrottled endpoints invite credential stuffing and scraper-driven cost blowouts — cheap to prevent, expensive to learn.

  10. An incident response path for security events is documented (who, how, legal duty)

    required

    A security incident with no defined path loses its 72-hour notification window to confusion.

Run it against your real gaps

A checklist is most useful when you know which controls you are actually missing. A free OpsRoadmaps assessment scores your controls with explainable findings and builds a roadmap from the results.

Assess my stack

Checklists document self-reported practice. Items were last reviewed 2026-09-19 — adapt them to your own environment.