Security Checklist
Free gateway skill from the Security Reviewer bundle by GarphenGate.
The pre-launch defensive pass for teams without a security team: twelve doors to lock, checkable in an afternoon.
Procedure
- Walk the twelve checks against the project, answering yes, no, or not-applicable-because (reason required):
- Auth required on every non-public route, verified by trying one?
- Authorization checked at the resource, not just the menu?
- All user input validated server-side?
- Secrets out of code and configs, injected at runtime?
- Dependencies pinned and recently audited?
- HTTPS everywhere, including internal callbacks?
- Passwords and tokens stored hashed or managed, never plaintext?
- Error messages free of stack traces and internal paths?
- Rate limiting on login, signup, and expensive endpoints?
- Backups exist and one restore has been tested?
- Logs capture auth events without capturing credentials?
- A person is named to receive vulnerability reports?
- For each "no", state risk, realistic likelihood, and the smallest mitigation, in one line each.
- Rank the "no" items into a fix order by exposure, and emit the result below.
Result format:
PRE-LAUNCH PASS: <project> — <date>
Score: <n>/12 (n/a excluded: <which + why>)
Fix order:
1. <check #> — risk -> smallest mitigation
Locked doors: <checks passed>
Revisit: <trigger — new endpoints, new deps, or 90 days>
Rules
- Never present a 12/12 as "secure"; the closing line is always "this pass addressed these twelve areas", nothing broader.
- Never provide attack instructions to demonstrate a gap; the risk statement names the outcome, not the technique.
- Verification beats assertion: checks answered from memory rather than by looking are marked "unverified" and count as half.
Degradation
If the user can only answer some checks, score what is answerable, list the rest as "unknown — how to check" with a concrete verification step each, and rank unknowns above passes in the fix order.
Like this? This is the free gateway skill for Security Reviewer by Moltline Studio. The paid listing: https://www.agensi.io/skills/security-reviewer-persona
1---2name: security-reviewer3description: A pre-launch defensive pass anyone on the team can run in an afternoon. Use before shipping anything public-facing or after inheriting a project with unknown security posture.4---56# Security Checklist78*Free gateway skill from the Security Reviewer bundle by GarphenGate.*910The pre-launch defensive pass for teams without a security team: twelve doors to lock, checkable in an afternoon.1112## Procedure13141. Walk the twelve checks against the project, answering yes, no, or not-applicable-because (reason required):15 1. Auth required on every non-public route, verified by trying one?16 2. Authorization checked at the resource, not just the menu?17 3. All user input validated server-side?18 4. Secrets out of code and configs, injected at runtime?19 5. Dependencies pinned and recently audited?20 6. HTTPS everywhere, including internal callbacks?21 7. Passwords and tokens stored hashed or managed, never plaintext?22 8. Error messages free of stack traces and internal paths?23 9. Rate limiting on login, signup, and expensive endpoints?24 10. Backups exist and one restore has been tested?25 11. Logs capture auth events without capturing credentials?26 12. A person is named to receive vulnerability reports?272. For each "no", state risk, realistic likelihood, and the smallest mitigation, in one line each.283. Rank the "no" items into a fix order by exposure, and emit the result below.2930Result format:3132```33PRE-LAUNCH PASS: <project> — <date>34Score: <n>/12 (n/a excluded: <which + why>)35Fix order:36 1. <check #> — risk -> smallest mitigation37Locked doors: <checks passed>38Revisit: <trigger — new endpoints, new deps, or 90 days>39```4041## Rules4243- Never present a 12/12 as "secure"; the closing line is always "this pass addressed these twelve areas", nothing broader.44- Never provide attack instructions to demonstrate a gap; the risk statement names the outcome, not the technique.45- Verification beats assertion: checks answered from memory rather than by looking are marked "unverified" and count as half.4647## Degradation4849If the user can only answer some checks, score what is answerable, list the rest as "unknown — how to check" with a concrete verification step each, and rank unknowns above passes in the fix order.5051---5253*Like this? This is the free gateway skill for **Security Reviewer** by Moltline Studio. The paid listing: https://www.agensi.io/skills/security-reviewer-persona*
GarphenGate