Free Resources
Security Checklists
Free, actionable security checklists developed by BugFoe's certified security professionals based on thousands of real-world security assessments. Each checklist includes severity ratings so your team can prioritize the most critical controls first.
Web applications are the most targeted attack surface in the enterprise. This checklist — derived from thousands of BugFoe web application pen tests — covers every control the OWASP Testing Guide and OWASP Top 10 demand, plus additional checks drawn from real-world breach patterns. Use it during development, before launch, and as part of annual reviews.
Key Controls (showing 15 of 150)
All authentication endpoints enforce account lockout after 5–10 failed attempts with progressive delays
CriticalPasswords are hashed with bcrypt, scrypt, or Argon2 (minimum cost factor 12); MD5 and SHA-1 are prohibited
CriticalSession tokens are cryptographically random, at least 128 bits, and regenerated after login and privilege changes
CriticalAll user-supplied input is validated server-side; client-side validation is treated as UX only, never a security boundary
CriticalParameterized queries or prepared statements are used for every database interaction — no string concatenation in SQL
CriticalCSRF tokens are present and validated on all state-changing requests (POST, PUT, PATCH, DELETE)
HighContent-Security-Policy header is implemented and prohibits 'unsafe-inline' and 'unsafe-eval'
HighAll output rendered in HTML is context-appropriately encoded (HTML entity, URL, JS, CSS encoding as applicable)
HighObject-level and field-level authorization checks are enforced on every API endpoint, not just at the route level
HighSensitive data (PII, credentials, payment info) is never logged; log statements are reviewed in code review
HighHTTPS is enforced site-wide with HSTS including 'includeSubDomains' and a minimum max-age of 1 year
CriticalFile upload endpoints validate MIME type, file extension, and content magic bytes server-side; files are stored outside the web root
HighThird-party dependencies are tracked via SCA tool (Snyk, Dependabot); critical CVEs are remediated within 30 days
MediumError messages returned to users are generic; detailed stack traces and system information are never exposed
MediumRate limiting is applied to authentication, password reset, and registration endpoints to prevent brute-force and enumeration
HighStop Waiting for a Breach. Start with BugFoe.
Get a free security assessment from our certified penetration testing and managed security experts.