The 5-Minute Checklist

• Auth & roles: verify protected routes return 401/403 when cookies/tokens are missing or swapped.
• Session storage: ensure httpOnly, secure, SameSite=Lax cookies; no tokens in localStorage.
• Tenant scoping: reject org switching without server-side verification; test cross-org IDORs.
• Rate limiting: add per-IP + per-user limits on login, signup, OTP, and webhook endpoints.
• Secrets: search for .env echoes, debug routes, and process.env logs; block /api/debug.
• Uploads: enforce file type/size, store outside web root, scan for malware, and use presigned URLs.
• Prompt hygiene: escape AI output, strip HTML/script tags, and keep secrets out of context windows.
• CORS: restrict origins; avoid * on credentials; lock down preflight.
• Headers: set CSP, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin.
• Payments: verify webhook signatures, forbid client-trusted amounts, and double-check idempotency keys.
• Email magic links: expire tokens quickly, single-use only, and tie to device fingerprint.
• Background jobs: protect internal queues with auth; avoid exposing /api/cron without checks.
• Admin: require MFA and role checks server-side; no admin-only buttons that just hide in the UI.
• Third-party keys: scope API keys to minimal perms; rotate keys used in demos.
• Logs: scrub PII and tokens; avoid sending secrets to client-side error trackers.
• SBOM: generate dependency list; flag critical CVEs; pin versions in lockfiles.
• Infra: default to NODE_ENV=production in staging; disable stack traces in prod.
• Monitoring: alert on 401/403 spikes, rate-limit hits, and unusual outbound traffic.
• Snapshots: add end-to-end snapshots so regen’d components don’t drop CSRF or auth bindings.
• People: add an on-call fix script: “If a user reports a leak, rotate keys + flush sessions.”

Make It Automatic with Vibe-Eval

• Run the “Cursor Quick Scan” profile: hits auth, uploads, and prompt injection in under 10 minutes.
• Add the GitHub Action so every PR deploys to preview + scans before merge.
• Use red-team mode weekly to throw weird payloads at chatbots and AI-driven flows.

Key Takeaways