---
title: "Security Checklist for Web Apps - 71 Items"
slug: security-checklist-web-apps-71-items
date_published: 2026-02-25T10:00:00.000Z
original_url: https://www.tigzig.com/post/security-checklist-web-apps-71-items
source: fresh
processed_at: 2026-02-25T10:00:00.000Z
---

# Security Checklist for Web Apps - 71 Items...all practical stuff...

![Security Checklist](/images/blog/security_01.png)

My endpoints got hammered recently. I deserved it. My AI Coder (Claude Code now) flags security issues on every audit. Some I fix.. some I plan to do 'in a bit'.. but never come around to it...

Client apps: always hardened with OAuth, rate limits, API logs - that's mandatory. But my 30+ public apps... I tend to get negligent.

Now I've setup a proper checklist.... 71 items across React, FastAPI, Postgres, DuckDB, Cloudflare, MCP servers, Auth & VPS security... all detected in my apps... with the fixes + practical issues I faced when implementing the fixes. Each item in plain English with a basic code fix for reference.

There is nothing like a 100% checklist ...would be updating this as I go along

Now every app - my AI Coder has to run it past this checklist before release. No exceptions...at least that's the plan.

If you come from a data science background like me - this stuff is new. Otherwise, IT world has been doing this for decades. But for analysts and data scientists now building tools... whether freelance or inside a company... very very important stuff..

Full checklist on site with a copy-to-markdown button. Paste it to your AI coder - it will explain, execute, customize for you..
[tigzig.com/security](https://tigzig.com/security)

---

### Earlier Infra Guides

- Part 1: [AI Coder](https://tigzig.com/post/self-hosting-infrastructure-ai-tool-builders-2026-part-1-ai-coder)
- Part 2: [Deployment & Hosting](https://tigzig.com/post/2026-infra-guide-part-2-deployment-hosting)
- Part 3: [Security (updated)](https://tigzig.com/security) this one... tigzig.com/security
- Part 4: [CORS](https://tigzig.com/post/fast-tips-what-is-cors-and-how-to-fix-it)

<!-- blog-sidebar-related -->
## Related

Tools: [TREMOR - Macro Stress Signals](https://www.tigzig.com/tremor), [Quants Agent](https://www.tigzig.com/n8n-tech-analysis)

Explore: [Security checklist](https://www.tigzig.com/security), [MCP servers and agents](https://www.tigzig.com/apis), [Database AI apps](https://www.tigzig.com/database-landing)

More posts: [2026 Infra Guide for AI Tool Builders - Part 3: The 18 Common Security Mistakes and How to Fix Them](https://www.tigzig.com/post/2026-infra-guide-part-3-security-mistakes), [2026 Infra Guide for AI Tool Builders - Part 5: Perimeter Security on Cloudflare (Free Plan)](https://www.tigzig.com/post/perimeter-security-cloudflare-free-plan), [My Public MCP Server Got Hammered - Security Lessons from a Bot Attack](https://www.tigzig.com/post/mcp-server-bot-attack-security-lessons), [Your API Key Is Visible in the Browser. Even if you put it as Vercel's 'secret' backend env variable.](https://www.tigzig.com/post/your-api-key-is-visible-in-the-browser), [Server Meltdown: How Bots Crashed My AI Tools and What I Did About It](https://www.tigzig.com/post/fail2ban-server-security-bots-ai-tools)

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/post/security-checklist-web-apps-71-items
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms