Security Checks I Apply Before Shipping a Web Feature
A practical checklist for reviewing inputs, authentication assumptions, authorization, uploads, dependencies, and deployment configuration.
Security work starts before a feature is released. The first review does not need to be dramatic. It needs to answer basic questions about data, access, files, dependencies, and deployment.
These are the checks I prefer to make visible during implementation.
Check every input boundary
Request bodies, route parameters, query strings, uploaded files, and webhook payloads should be validated before they influence application logic.
Validation should describe the shape the feature accepts. If a value is required, typed, limited, or tied to a known set of options, the code should say so at the boundary.
Review authentication assumptions
Every feature should identify who can call it. Public visitors, signed-in users, administrators, background jobs, and third-party services carry different assumptions.
If the caller is not clear, the authorization check usually becomes unclear too.
Keep authorization close to the resource
Route-level protection is not enough by itself. A user may be authenticated and still have no right to read or change a specific record.
The review should ask whether ownership, role, or permission checks are applied to the actual resource being touched.
Treat file uploads as high-risk input
Uploads need limits. File type, size, storage location, public access, and later download behavior should be decided intentionally.
If the application accepts documents or images, the upload flow should be reviewed separately from normal text input.
Check dependencies and environment
Before release, dependency warnings, exposed secrets, permissive environment values, and public server access should be reviewed. These are basic checks, but they prevent avoidable mistakes.
Security is not a label added to the UI. It is a set of constraints that should be visible in how the feature accepts data, checks access, and reaches deployment.