Security Pre-Flight & Code Review Checklist
The Security Checklist is an engineering defense shield applied to every pull request and pre-release build. It guarantees that developers never commit hardcoded passwords or API keys, sanitize all incoming database queries against SQL injection, verify server-side authorization on every endpoint, and patch vulnerable open-source dependencies before code reaches production.
Plain-Language Executive Summary
The Security Checklist is a protective shield applied to every pull request. It ensures developers never commit passwords or API keys, always sanitize user inputs, and block known open-source software vulnerabilities before code reaches production.
Applied at pre-commit git hooks, during pull request reviews, and in continuous integration build runners.
Security Best Practices: Good vs. Bad Examples
Anti-Pattern Practice
Committing an AWS secret key to a private Git repo or concatenating SQL queries with raw user string variables.
Verified Standard
Injecting ephemeral secrets via AWS Secrets Manager and enforcing parameterized ORM query bindings in all repository methods.
Authoritative Security Criteria (5 Items)
SEC-INP-00010-00a0-00Input Validation & Parameterized Database Queries
All user-supplied parameters are validated against allowlist schemas and passed to database queries via parameterized placeholders.
SEC-SEC-00020-00a0-00Zero Hardcoded Secrets & Token Verification
Code contains zero API tokens, private keys, or passwords; all secrets are retrieved from centralized secret vaults.
SEC-AUT-00030-00a0-00Server-Side Access Control & Ownership Verification
All API endpoints verify user identity and enforce tenant record ownership on every request to prevent IDOR vulnerabilities.
SEC-DEP-00040-00a0-00Software Composition Analysis (SCA) Clean
All third-party open source packages (npm, pip, cargo) have zero known Critical or High severity CVE vulnerabilities.
SEC-LOG-00050-00a0-00Security Audit Logging Without PII/PHI Leakage
All authentication events, privilege escalations, and sensitive data exports emit structured JSON logs without exposing passwords or PHI.
Shift-Left Security Gate Integration in CI/CD
Security checklist criteria run prior to code merge, failing pipeline builds on critical vulnerabilities:
# CI Security Scan Configuration - name: SEC-SEC-00020: Secret Detection Gate run: gitleaks detect --source . --verbose --redact - name: SEC-INP-00010: SAST Static Security Scan run: semgrep scan --config=auto --error - name: SEC-DEP-00040: Software Composition Analysis (SCA) run: npm audit --audit-level=high
Copy this prompt into your AI coding assistant to perform an automated pre-flight security review on your code changes.
Next Checklist Gate: Compliance & Regulatory Release Checklist
Learn how to verify Design History Files (DHF), risk files, and cryptographic release signatures.
Community Discussion & Feedback
Attributed peer feedback and official Netspective architecture notes.