security-baseline

name	security-baseline
description	OWASP security checklist for code changes

Security Baseline

When writing or reviewing code, check for these common vulnerabilities.

Input Validation

• Validate and sanitize all user input at system boundaries
• Use parameterised queries — never string-concatenate SQL
• Escape output for the target context (HTML, shell, URL)

Authentication & Authorization

• Never store plaintext passwords
• Check authorization on every request, not just at the UI layer
• Use constant-time comparison for secrets

Data Handling

• Never log secrets, tokens, or credentials
• Use environment variables or secret managers for sensitive config
• Set appropriate file permissions on config files

Dependencies

• Pin dependency versions
• Check for known vulnerabilities before adding new packages
• Keep dependencies up to date