---
name: app-security-checklist
description: >-
  Application security checklist when adding auth, APIs, user input, uploads,
  payments, or handling secrets. Use for security review of app code (not the
  Cursor /review-security subagent launcher).
metadata:
  origin: ECC security-review cherry-pick (lean)
  imported: "2026-07-29"
---

# App security checklist (lean)

Use when implementing or reviewing auth, APIs, uploads, secrets, or sensitive data.
For Cursor’s built-in branch security review subagent, use `/review-security` instead.

## Secrets

- No hardcoded keys/tokens/passwords in source
- App secrets → Infisical (`/apps/<repo>`); infra → Ansible Vault
- Local `.env` gitignored; commit `*.example` only
- Never log secrets, full tokens, card numbers, or passwords

## Input & data

- Validate/parse untrusted input (schema libs OK: zod, pydantic, etc.)
- Parameterized queries / ORM only — no string-concat SQL
- Uploads: size + type/extension allowlist; store outside web root when possible
- Sanitize any user HTML; prefer framework auto-escaping

## AuthZ

- Check authorization on every sensitive action (not only at login)
- Prefer httpOnly + Secure + SameSite cookies over localStorage tokens
- Generic client errors; detail only in server logs

## HTTP / abuse

- Rate-limit auth and expensive endpoints
- CSRF protection on cookie-session state changes
- Sensible security headers (CSP without casual `unsafe-inline`/`unsafe-eval`)
- CORS allowlist — not `*` with credentials

## Dependencies

- Lockfiles committed; CI uses reproducible install (`npm ci` / equivalent)
- Do not silence audit/lint gates with `|| true`

## Pre-ship gate (short)

Secrets out of git · inputs validated · queries parameterized · authZ on
mutations · no secret logging · rate limits on hot paths · CI gates honest.