Every week we see the same pattern: a site goes live with a public form, an API key pasted straight into the code, and zero server-side validation. None of this is exotic — it's the same 20 points, over and over.
What's almost always missing
It's not a budget problem or "we ran out of time." It's that nobody sat down to run the full list before saying "okay, it's live." So we turned it into a standing checklist — the same one we now run in every office before calling any site launched.
"Hiding an API key isn't optional — it's the first item on the list, and the most ignored."
The short version: secrets out of the repo, authentication validated server-side (not just a hidden button), parameterized queries, security headers, and HTTPS forced everywhere. The full version — all 20, explained one by one — is in the PDF below.
When each point applies
If your site is a static landing page with no backend, several points don't apply yet — but the moment you add a form with a database, a login, or a public webhook, the full list comes into play.
- Secrets & keys — never hardcoded, never in Git history
- Authentication & data access — always validated server-side
- Input & content — every input validated, every user-generated piece of content escaped
- Network & abuse — rate-limiting, anti-bot protection, and security headers on everything public