Security Audit Checklist

Run these checks on any system before shipping to production or after major changes.

Before you start

The checklist itself is prose and needs nothing. The three scanners under scripts/ are Python, so running those needs Python 3 on your machine (python3 --version). Without it you can still work the checklist by hand; you just do not get the automated secret scan, header check and IaC read.

1. Privacy & Data Governance

• Privacy policy exists if the app collects, stores, or processes any user data. Link it in the footer and signup flows.
• Know where user data is stored: document the primary database, caches, logs, backups, and third-party services. Check data residency requirements (GDPR, CCPA).
• Data minimization: only collect what you need. Delete or anonymize data you do not use.

2. Secret & Key Hygiene