Writeup · In Progress
Secure-by-default checklist
How I harden my own sites and APIs while I learn security in public.
Secure-by-default checklist (my builds)
I use this as a living checklist for sites and APIs I own — not a certification or audit standard.
- Input validation — schema validation on every boundary; reject early.
- AuthN & authZ — least privilege, session hygiene, no security by obscurity.
- Rate limiting — protect auth and write endpoints from abuse.
- Headers — sensible CSP, HSTS where HTTPS is fixed, minimal exposure.
- Secrets — environment variables only; never commit keys; rotate when leaked.
- Dependencies — regular updates, lockfiles, and quick patches for critical CVEs.