Security Baseline for Web Apps
Define mandatory minimum security controls across web applications.
Recommended approach
Apply a baseline that includes:
- secure authentication/session management
- least-privilege access controls
- input validation and output encoding
- dependency hygiene and secret protection
- logging for security-relevant events
Alternatives and when to choose them
- Enhanced compliance baseline for regulated industries.
- Reduced baseline only for non-production experiments.
Implementation checklist
- Add security headers and transport security defaults.
- Add abuse controls to auth and public endpoints.
- Ensure backup and incident response processes exist.
Common pitfalls
- Security checks treated as a final pre-release step only.
- Missing threat model for high-risk features (payments, file upload, admin actions).