Dependencies, logging and process
Security is not a one-time pass. These items are about the code you did not write (your dependencies) and the habits that keep an app safe after launch.
Checklist
- Pin and scan dependencies. Commit a lockfile, and run a vulnerability scanner (and your platform's audit) in CI. Update known-vulnerable packages.
- Watch for hallucinated packages. AI tools sometimes import a package that does not exist; attackers register those names with malware ("slopsquatting"). Confirm every dependency is the real, intended one before installing.
- Do not run untrusted code or build steps blindly. A downloaded repo or a generated postinstall script can run arbitrary code. Review before you run.
- Log security events, not secrets. Record logins, failures, rate-limit hits, and admin actions for audit. Never log passwords, tokens, keys, or full card numbers.
- Handle errors without leaking. Catch exceptions, return a generic message, and keep stack traces and queries in server logs only.
- Keep a static analysis pass in CI. Tools like Semgrep catch injection and authz mistakes before they merge.
- Test like an attacker. Your test suite should include invalid input and unauthorized-access cases, not only the happy path. After the suite passes, run a black-box scanner (for example OWASP ZAP) against the deployed URL.
- Get an independent review. A self-audit misses things, especially the author's own blind spots. Before a wider launch, buy an external penetration test, and consider mapping to a standard such as OWASP ASVS.
- For AI features, test the model layer. If your app puts untrusted content into a prompt, red-team it for prompt injection and for leaking data across users or tenants. Keep the real security in code (scope every tool and query to the current user), never in the prompt's instructions.
- Have a way back. Keep backups you have actually restored from, and a plan for rotating secrets and revoking sessions if something leaks.
How to test
- Run your dependency audit and a secret scan in CI and read the output.
- Point a black-box scanner at staging.
- Ask someone who did not write the code to try to break it.