Security Audit Checklist

Audit your application security with a structured approach to authentication, data protection, infrastructure hardening, and vulnerability management.

Checklist: Security Audit (engineering)

Security vulnerabilities are discovered after deployment, not during development. A structured security audit catches common weaknesses before attackers do. This checklist covers the critical areas from authentication and authorization through data protection and infrastructure security.

Checklist Items

  1. Verify authentication implementation [critical]: Audit password hashing (bcrypt/argon2), session management, MFA, and account lockout policies.
  2. Review authorization and access controls [critical]: Verify RBAC implementation, ensure users cannot access other users data, and test privilege escalation paths.
  3. Scan for OWASP Top 10 vulnerabilities [critical]: Run automated scanners for SQL injection, XSS, CSRF, SSRF, and other OWASP Top 10 issues.
  4. Audit data encryption [important]: Verify encryption at rest for databases and file storage, TLS for all network communication, and key management.
  5. Review dependency vulnerabilities [important]: Scan all dependencies with Snyk, Dependabot, or npm audit. Patch critical and high severity issues.
  6. Verify secrets management [important]: Ensure no hardcoded API keys, passwords, or tokens in code, configs, or Docker images.
  7. Audit logging and monitoring [important]: Verify security events are logged with timestamps, user context, and IP addresses for incident response.
  8. Test rate limiting and abuse prevention [recommended]: Verify rate limits on authentication, API, and form submission endpoints to prevent brute force and abuse.
  9. Review CORS and CSP policies [recommended]: Ensure CORS headers restrict origins appropriately and Content Security Policy prevents inline script execution.
  10. Conduct penetration testing [recommended]: Perform manual penetration testing on critical flows including authentication, payment, and admin functions.

Common Mistakes

  • Security as an afterthought: Integrate security scanning into CI/CD. Catch vulnerabilities during development, not after deployment.
  • Ignoring dependency vulnerabilities: Enable automated dependency scanning and patch critical vulnerabilities within 48 hours of disclosure.
  • Overly broad CORS policies: Never use wildcard CORS origins in production. Whitelist specific trusted domains.

Frequently Asked Questions

How often should I conduct security audits?
Quarterly for high-risk applications, semi-annually for most applications, and after any major feature release or architecture change.
Should I hire external penetration testers?
Yes, at least annually. Internal teams develop blind spots. External testers bring fresh perspective and adversarial thinking.
What is the most commonly exploited vulnerability?
Broken access control is the number one OWASP vulnerability. Users accessing data or functions they should not have permission to reach.