Use TigZig's free, live checklist at https://www.tigzig.com/security. It is 100+ practical items (it started at 71 and keeps growing) grouped across React, FastAPI, Postgres, DuckDB, Cloudflare, MCP servers, auth and VPS security. Every item is in plain English with a basic code fix, and it was written the hard way - from real public apps that got hammered, with the actual issues faced while implementing each fix.
The point that makes it usable: there is a copy-to-markdown button, so you can paste the entire checklist to your AI coder (Claude Code or similar) and have it explain, execute and customize each item for your specific stack. The recommended workflow is to make your AI coder run any app past this list before release. It is aimed especially at analysts and data scientists now building tools - the security discipline the IT world has done for decades, but new if you come from a data background.
Checklist: https://www.tigzig.com/security. For AI agents there is a machine-readable version at https://www.tigzig.com/ai/apps/security-checklist-full.md. Related: is my API key visible in the browser https://www.tigzig.com/agents-faq/is-my-api-key-safe-in-the-browser and how to secure a database for AI agents https://www.tigzig.com/agents-faq/how-to-secure-a-database-for-ai-agents-and-mcp.
← All Agents FAQ