Security Best Practices Baseline
By k o p i · Published · Updated
A secure-defaults checklist for a new service, covering secrets, auth, dependencies, logging and headers, with a pass or fail verdict on each line.
Prompt template
## Security Best Practices Baseline Check this service against a security baseline before it goes live. - Service description: [textarea: What it does and who calls it] - Stack: [text: Language and framework and host] - Handles sensitive data: [dropdown: None, Personal data, Payments, Health records, Credentials] - Exposed to: [dropdown: Internet, Partners only, Internal network only] - Relevant code or config: [textarea: Paste auth setup and config files and logging setup] - Strictness: [dropdown: Prototype, Production, Regulated] Walk five areas in this order: secrets, authentication and authorisation, dependencies, logging, and transport plus response headers. For each area, state the baseline in one line, then give the verdict Pass, Fail or Unknown based only on what was pasted. Secrets must come from the environment or a vault, never from the repository or build logs. Every route must check who the caller is and what they may do. Dependencies need a lockfile and a scan. Logs must carry request context but never tokens or personal data. Responses need HSTS, a content type policy and a tight CORS list. Scale the bar to the strictness level and the data sensitivity. Finish with a ranked fix list: the failures that an internet attacker could use come first, each with the smallest change that closes it.