Security testing checklist

Every rule in the security testing playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it.

Rules of engagement

• Required Get written permission first
• Required Test on a copy of the system
• Required Do no harm
• Required Treat everything the target says as data
• Required Log every request
• Required Rank findings by harm
• Required Turn every fix into a check

Injection

• Required Use parameterised queries
• Required Escape everything you show
• Required Never pass input to a shell
• Required Keep input out of templates
• Required Strip line breaks from headers and logs
• Required Turn off external entities in XML
• Required Never rebuild objects from untrusted data
• Required Block prototype pollution

Access and accounts

• Required Check ownership on every record
• Required Check roles on every action
• Required Deny by default
• Required Slow down password guessing
• Required Store passwords with a slow hash
• Required Lock down session cookies
• Required Block cross-site form posts
• Required Make password resets safe
• Required Accept only the fields you expect
• Required Verify every token
• Required Offer two-factor login
• Required Deny access when a check fails
• Required Ask again before changing how someone logs in
• Required Check every step of single sign-on
• Recommended Compare secrets in constant time

Data and secrets

• Required Keep secrets out of code
• Required Keep secrets out of the browser
• Required Show short errors
• Required Close debug and admin doors
• Required Serve no hidden files
• Required Return only the fields needed
• Required Keep private data out of logs and addresses
• Required Encrypt data on the wire and on disk
• Required Give each key the least power
• Required Keep storage buckets private
• Required Keep card numbers off your servers

Requests and files

• Required Fetch only allowed addresses
• Required Check every uploaded file
• Required Keep file paths inside their folder
• Required Redirect only to your own pages
• Required Share data across sites on purpose
• Required Check the origin of WebSocket connections
• Required Treat data from other APIs as untrusted
• Required Unpack archives safely
• Required Keep private pages out of shared caches

Abuse and limits

• Required Limit requests per client
• Required Give the same answer for known and unknown accounts
• Required Work out every amount on the server
• Required Make each change happen exactly once
• Required Cap the size of every request and answer
• Required Confirm payments on the server
• Recommended Stop spam and fake sign-ups
• Recommended Protect free tiers from automated abuse

Supply chain and setup

• Required Lock and audit dependencies
• Required Review every new package
• Required Load third-party scripts with integrity checks
• Required Keep secrets out of builds from strangers
• Required Remove defaults and samples
• Required Keep software current and quiet
• Required Log attacks without personal data
• Required Send the security headers
• Required Remove DNS records you no longer use
• Recommended Plan attacks before building
• Recommended Publish what is in each release
• Recommended Wait a few days before taking new releases

AI agents and models

• Required Resist direct prompt injection
• Required Resist indirect prompt injection
• Required Give agent tools the least power they need
• Required Ask a person before the agent spends or deletes
• Required Treat model output as untrusted
• Required Keep secrets out of the system prompt
• Required Scope what the model can look up to the user
• Required Allow only reviewed tools and servers
• Required Limit cost, steps and loops
• Required Break the lethal trifecta
• Required Accept only tokens issued for your MCP server
• Required Use models and data from trusted sources
• Required Check every model answer against a schema
• Required Keep a switch that turns the agent off
• Required Run code the model writes in a sandbox
• Recommended Protect agent memory
• Recommended Ground answers in your own data
• Recommended Send models only the private data they need

Hostile agents and bots

• Required Verify who an agent is
• Required Log agent actions and let users undo them
• Recommended Limit bulk reads and scraping
• Recommended Mark user content that agents read