Web Application Security Checklist

What this checklist is

A release checklist for web apps and APIs, organised around the OWASP Top 10:2025 and the OWASP cheat sheets. Each check tells you how much it matters and exactly how to confirm it is done, from access control and sessions to headers, dependencies, logging and file uploads.

It has 8 chapters and 35 checks, each with how to verify it and how much it matters. For web developers shipping to production.

Chapter by chapter

1. Access control (A01) (5 checks)

Broken access control is the top risk in the 2025 list. These checks make sure every request is authorised on the server, for the right user and the right object.

2. Authentication and sessions (A07) (5 checks)

How you store passwords, slow down guessing and manage sessions decides whether one leaked password or cookie becomes an account takeover.

3. Injection (A05) (4 checks)

Injection happens when user input is treated as part of a query or command. These checks keep data and code apart.

4. Cross-site scripting and Content Security Policy (4 checks)

XSS lets an attacker run script as your user, which defeats CSRF tokens and steals data. Encode output by default and add a strict CSP as a second layer.

5. CSRF and cookies (3 checks)

Cookies carry your sessions, so their flags matter. These checks stop other sites from using your users' cookies against them.

6. Security headers and configuration (A02) (4 checks)

Security misconfiguration is number two in 2025. Headers, TLS and production settings are cheap to fix and easy to check from outside.

7. Supply chain, integrity and secrets (A03, A08) (5 checks)

Software supply chain failures are new at number three. Your app is only as safe as the packages, build steps and keys it depends on.

8. Logging, errors and file uploads (A09, A10) (5 checks)

You cannot respond to an attack you never see, and an error that fails open can be worse than the bug that caused it. File uploads close the list because they mix several of these risks.

How it works on Sefism

The checklist is one page: each check has a severity (must, should or nice to have) and a concrete way to verify it, and members can tick checks off as they go. Every chapter is open to everyone.

Every claim is checked against the sources listed on the page (8 cited).