Web App Security Checklist

A practical, vendor-neutral checklist for anyone shipping a web app, whether you hand-wrote every line or built it by prompting an AI ("vibe coding"). AI writes code that passes the happy path and still ships real holes, so a working feature proves nothing about safety. This checklist is what to actually verify before and after you go live.

It is organised by category. Start anywhere, or walk them in order. Each page lists concrete checks: what to test, why it matters, and how to fix it.

How to use it

• Treat each item as a test, not a reading. Try the attack, then confirm the fix.
• Test with invalid input and as the wrong user, not just the normal flow.
• After the code looks right, run a scan against the deployed URL to catch anything that regressed between prompts.

Categories

• Authentication and sessions: how people prove who they are, and how you keep them signed in without letting the token be stolen.
• Authorization and access control: making sure a logged in user cannot read or change data that is not theirs (IDOR, multi-tenancy).
• Input validation and injection: SQL injection, XSS, SSRF, unsafe deserialization, and file uploads.
• APIs and requests: CSRF, CORS, mass assignment, and request-shape attacks.
• Secrets and data protection: keys, encryption at rest and in transit, personal data, and data rights.
• Availability and abuse: rate limiting, denial of service, and runaway resource consumption.
• Infrastructure and deployment: ports and firewalls, containers, security headers, TLS, and exposed admin panels.
• Dependencies, logging and process: supply chain, secrets in git, error handling, monitoring, and independent testing.

The short version

If you only have an hour, check these five first. They are the most common and the most damaging in real audits:

1. Broken access control. Log in as user A, request user B's object by id. If it comes back, you have a hole. See authorization.
2. Secrets in the client or in git. Grep the browser bundle and the repo for keys. Anything committed is compromised. See secrets.
3. No rate limiting on login. Brute force is trivial without it. See availability.
4. Missing CSRF or login-CSRF protection. See APIs and requests.
5. Ports open past the firewall. Containers often publish ports around the firewall. See infrastructure.

This checklist is published by the Arc OS team. We hold our own product to it; you are free to use it on yours. It is a starting baseline, not a certification, and it does not replace an independent penetration test.