---
title: "Application security: all 108 rules · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/checklist
updated: 2026-10-27
build: a2a6bdfed830
tokens: 9167
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---
# Application security checklist
For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Application security](https://agentwranglers.se/playbook/application-security.md).
By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.
Every rule in the application security playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. This is a lot to check. [An Expert can check it for you](https://agentwranglers.se/contact.md).
**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers application security playbook`. In code you write, add a comment next to it with the same link.
## Threat modelling
- [ ] APS-1 **Recommended** [Plan attacks before building](https://agentwranglers.se/playbook/application-security/threat-modelling/threat-model.md): Write a threat model before building a change that touches money, accounts, personal data or a new outside connection. A second person reviews it before the change can merge.
- [ ] APS-93 **Recommended** [Draw the data flows and their trust boundaries](https://agentwranglers.se/playbook/application-security/threat-modelling/data-flow-diagram.md): Keep a data-flow diagram for each app in the repository. It shows every process, data store, outside party and flow, and a line wherever trust changes.
- [ ] APS-94 **Recommended** [Find threats at every boundary with STRIDE and LINDDUN](https://agentwranglers.se/playbook/application-security/threat-modelling/stride-and-linddun.md): For every element and boundary crossing in the data-flow diagram, ask each STRIDE question. Where the flow carries personal data, also ask each LINDDUN question. Record every threat with a decision.
- [ ] APS-95 **Recommended** [Write abuse cases next to user stories](https://agentwranglers.se/playbook/application-security/threat-modelling/abuse-cases.md): For each user story that touches money, accounts, personal data or a new outside connection, write at least one abuse case. It says how someone could misuse the feature and what the app must do instead.
- [ ] APS-96 **Recommended** [Pick an ASVS level for each app](https://agentwranglers.se/playbook/application-security/threat-modelling/asvs-level.md): Choose an OWASP ASVS 5.0 level for each app and write it in the repository. Check the app against every requirement of that level before each major release.
## Input and injection
- [ ] APS-2 **Required** [Use parameterised queries](https://agentwranglers.se/playbook/application-security/input-and-injection/sql-injection.md): Send every database query with placeholders, and pass user input as separate values. Never build a query by joining strings.
- [ ] APS-97 **Required** [Keep query operators out of document database input](https://agentwranglers.se/playbook/application-security/input-and-injection/nosql-injection.md): Where a document database query expects a plain value, accept only that value. Reject request objects with keys that start with `$`, and never pass input to `$where` or server-side JavaScript.
- [ ] APS-3 **Required** [Escape everything you show](https://agentwranglers.se/playbook/application-security/input-and-injection/cross-site-scripting.md): Escape untrusted text for the place it lands in a page, and back it up with a strict Content Security Policy.
- [ ] APS-4 **Required** [Never pass input to a shell](https://agentwranglers.se/playbook/application-security/input-and-injection/command-injection.md): Run other programs without a shell, with input as separate arguments. Better still, use a library instead of a program.
- [ ] APS-5 **Required** [Keep input out of templates](https://agentwranglers.se/playbook/application-security/input-and-injection/template-injection.md): Pass user input to a template as data. Never use it as the template itself.
- [ ] APS-7 **Required** [Turn off external entities in XML](https://agentwranglers.se/playbook/application-security/input-and-injection/xml-entities.md): When the app parses XML, turn off external entities and document types in the parser, or accept JSON instead.
- [ ] APS-8 **Required** [Never rebuild objects from untrusted data](https://agentwranglers.se/playbook/application-security/input-and-injection/unsafe-deserialisation.md): Read untrusted data only as plain data, such as JSON. Never use formats that can rebuild code objects.
- [ ] APS-6 **Recommended** [Strip line breaks from headers and logs](https://agentwranglers.se/playbook/application-security/input-and-injection/header-injection.md): Remove or reject line breaks in any input that goes into a header, a redirect, an email header or a log line.
- [ ] APS-9 **Recommended** [Block prototype pollution](https://agentwranglers.se/playbook/application-security/input-and-injection/prototype-pollution.md): In JavaScript, never merge or copy untrusted objects in a way that lets keys such as `__proto__` change every object in the app.
- [ ] APS-98 **Recommended** [Escape input in directory queries](https://agentwranglers.se/playbook/application-security/input-and-injection/ldap-injection.md): Escape every value placed in an LDAP search filter or distinguished name with the library's escape function for that part. Never join raw input into a filter.
- [ ] APS-99 **Recommended** [Neutralise formulas in spreadsheet exports](https://agentwranglers.se/playbook/application-security/input-and-injection/csv-injection.md): In every CSV or spreadsheet export, quote each field as RFC 4180 says. Put a single quote before any value that starts with `=`, `+`, `-`, `@`, a tab, a carriage return or a line feed. Treat the full-width signs `＝`, `＋`, `－` and `＠` the same way.
## Authentication and sessions
- [ ] APS-10 **Required** [Slow down password guessing](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/login-guessing.md): Limit failed logins per account and per client address. Give the same error for a wrong user and a wrong password.
- [ ] APS-11 **Required** [Store passwords with a slow hash](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/password-storage.md): Store passwords only as a slow, salted hash made for passwords, such as Argon2id or bcrypt.
- [ ] APS-12 **Required** [Verify every token](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/token-checks.md): Check the signature, algorithm, expiry and audience of every signed token, such as a JWT. Give access tokens a life of 15 minutes or less. This is the one home of that limit.
- [ ] APS-15 **Required** [Trust an email domain only after strict parsing](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/strict-email-parsing.md): Before an email domain grants anything, such as joining an organisation or routing single sign-on, check the address against one plain `local@domain` shape. Refuse quotes, comments, encoded words, `%` and more than one `@`.
- [ ] APS-16 **Required** [Lock down session cookies](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/session-cookies.md): Mark session cookies `HttpOnly`, `Secure` and `SameSite=Lax` or `Strict`. Issue a new session at login and end it at logout, after idle time and after a fixed lifetime.
- [ ] APS-17 **Required** [Set cookies safely or not at all](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/cookie-attributes.md): Set every cookie with `Secure` and an explicit `SameSite`. Add `HttpOnly` to every cookie that no script reads. Use `SameSite=None` only for a cookie that must work inside another site.
- [ ] APS-18 **Required** [Block cross-site form posts](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/cross-site-requests.md): Make sure a change of state only comes from your own pages, with `SameSite` cookies plus a token or an origin check.
- [ ] APS-19 **Required** [Clear cached pages and data when someone signs out](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/clear-site-data-on-sign-out.md): On sign-out, delete everything the browser stored for the account. That covers the service worker's caches, local storage and cookies.
- [ ] APS-13 **Recommended** [Compare secrets in constant time](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/constant-time-compare.md): Compare tokens, signatures and codes with a constant-time function, so response times reveal nothing about how close a guess was.
- [ ] APS-14 **Recommended** [Make tokens from a secure random source](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/secure-random-tokens.md): Make session IDs, reset codes, API keys and invite links only with the platform's cryptographic random generator. Never use the plain random function, a timestamp or a counter.
## Access control
- [ ] APS-20 **Required** [Deny by default and when a check fails](https://agentwranglers.se/playbook/application-security/access-control/fail-closed.md): Make every route need a login unless it is on a named public list. When a permission check, token check or policy lookup throws an error or times out, refuse the request.
- [ ] APS-21 **Required** [Accept only the fields you expect](https://agentwranglers.se/playbook/application-security/access-control/mass-assignment.md): Copy only named fields from a request into a record. Never save the whole request body.
- [ ] APS-101 **Recommended** [Decide access in one policy module](https://agentwranglers.se/playbook/application-security/access-control/policy-decision-point.md): Answer every access question through one policy function or service, the policy decision point. Every route asks it "may this user do this action on this record?" and never decides alone.
- [ ] APS-22 **Recommended** [Return only the fields needed](https://agentwranglers.se/playbook/application-security/access-control/only-needed-fields.md): Each API reply returns only the fields the caller needs and may see. Never send a whole database record and let the page hide the rest.
## Browser security headers
- [ ] APS-23 **Required** [Make browsers always use HTTPS](https://agentwranglers.se/playbook/application-security/browser-security-headers/hsts.md): Send `Strict-Transport-Security` so browsers always use HTTPS. Give it a long `max-age` (at least a year) and `includeSubDomains`, on HTTPS responses only.
- [ ] APS-28 **Required** [Refuse to be framed](https://agentwranglers.se/playbook/application-security/browser-security-headers/frame-ancestors.md): Stop other sites from showing yours inside a frame. Use `frame-ancestors 'none'` (or a list) in the CSP, plus `X-Frame-Options` for older browsers.
- [ ] APS-100 **Recommended** [Send the security headers as one set](https://agentwranglers.se/playbook/application-security/browser-security-headers/header-set.md): Set every browser security header in one middleware or server block that runs for every response, including errors, redirects, files and API answers. Test the whole set as one unit.
- [ ] APS-24 **Recommended** [Load nothing over plain HTTP](https://agentwranglers.se/playbook/application-security/browser-security-headers/mixed-content.md): Load every file over HTTPS. Add `upgrade-insecure-requests` as a safety net.
- [ ] APS-25 **Recommended** [Allow only the scripts you wrote](https://agentwranglers.se/playbook/application-security/browser-security-headers/content-security-policy.md): Send a strict Content Security Policy, a header that says which scripts may run. Allow scripts only by nonce or hash, with `'strict-dynamic'`, `object-src 'none'`, `base-uri 'none'` and no `unsafe-inline`.
- [ ] APS-26 **Recommended** [Collect reports of blocked content](https://agentwranglers.se/playbook/application-security/browser-security-headers/reporting-endpoints.md): Name a place for browsers to send policy errors with `Reporting-Endpoints`. Log those reports without any personal data.
- [ ] APS-27 **Recommended** [Stop browsers guessing file types](https://agentwranglers.se/playbook/application-security/browser-security-headers/x-content-type-options.md): Send `X-Content-Type-Options: nosniff` on every response, so browsers don't guess file types. Give every response its correct Content-Type.
- [ ] APS-29 **Recommended** [Refuse odd requests from other sites](https://agentwranglers.se/playbook/application-security/browser-security-headers/fetch-metadata.md): Browsers send `Sec-Fetch-*` headers that say where a request came from. Use them to refuse cross-site requests that are not normal page visits.
- [ ] APS-30 **Recommended** [Keep other sites' windows apart](https://agentwranglers.se/playbook/application-security/browser-security-headers/cross-origin-isolation.md): Send `Cross-Origin-Opener-Policy: same-origin` and a `Cross-Origin-Resource-Policy`. These keep other sites' windows and pages away from yours. Add COEP only if you need full isolation.
- [ ] APS-31 **Recommended** [Share less in the Referer header](https://agentwranglers.se/playbook/application-security/browser-security-headers/referrer-policy.md): Keep `Referrer-Policy` at the browser default, `strict-origin-when-cross-origin`, or stricter. Send it on every response, so no framework default, meta tag or old browser loosens it.
- [ ] APS-32 **Recommended** [Switch off browser features you don't use](https://agentwranglers.se/playbook/application-security/browser-security-headers/permissions-policy.md): Use `Permissions-Policy` to turn off every browser feature the site does not use. Allow the rest only for your own origin.
- [ ] APS-33 **Recommended** [Lock scripts to a known hash](https://agentwranglers.se/playbook/application-security/browser-security-headers/subresource-integrity.md): Put an `integrity` hash, a fingerprint of the file, on every script and stylesheet. Let the browser refuse any script without one.
- [ ] APS-35 **Recommended** [Lock down risky DOM writes](https://agentwranglers.se/playbook/application-security/browser-security-headers/trusted-types.md): Require Trusted Types in the CSP, so scripts can't write raw HTML into the page. Send every remaining case through one small named policy.
- [ ] APS-37 **Recommended** [Share data across sites on purpose](https://agentwranglers.se/playbook/application-security/browser-security-headers/strict-cors.md): Allow other sites to read your API only from a fixed list of origins. Never copy the request's `Origin` into the reply when cookies are allowed.
- [ ] APS-38 **Recommended** [Check the origin of WebSocket connections](https://agentwranglers.se/playbook/application-security/browser-security-headers/websocket-origin.md): Accept a WebSocket connection only from your own origins, and only after checking the user's login, as for any other request.
- [ ] APS-39 **Recommended** [Check the sender of every window message](https://agentwranglers.se/playbook/application-security/browser-security-headers/postmessage-origin.md): When a page listens for messages from other windows or frames, accept only those from a fixed list of origins. Never send private data to the target origin `*`.
- [ ] APS-40 **Recommended** [Redirect only to your own pages](https://agentwranglers.se/playbook/application-security/browser-security-headers/block-open-redirects.md): A redirect that takes its target from the address must only go to your own pages or an allow-list.
- [ ] APS-34 **Optional** [Send a hash of the body](https://agentwranglers.se/playbook/application-security/browser-security-headers/digest-fields.md): Send a `Content-Digest`, a hash of the response body, on files clients download to verify, such as Markdown copies and downloads. RFC 9530 defines it.
- [ ] APS-36 **Avoid** [Sending the old XSS filter header](https://agentwranglers.se/playbook/application-security/browser-security-headers/x-xss-protection.md): Do not turn on `X-XSS-Protection`. The filter it controls is gone from current browsers, and in old ones it could open holes. Rely on the Content Security Policy instead.
## Requests, files and caches
- [ ] APS-41 **Required** [Fetch only allowed addresses](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/block-server-side-request-forgery.md): When the server fetches an address a user gave, allow only the hosts it needs. Never reach internal or cloud metadata addresses.
- [ ] APS-43 **Required** [Check every uploaded file](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/safe-file-uploads.md): Accept only the file types you need, check them by content, limit their size, and store them where they cannot run.
- [ ] APS-44 **Required** [Keep file paths inside their folder](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/block-path-traversal.md): Never build a file path from user input without proving the result stays inside the allowed folder.
- [ ] APS-46 **Required** [Keep private pages out of shared caches](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/private-responses-uncached.md): Mark every reply that depends on the logged-in user `Cache-Control: private`, and never let a CDN cache by file extension alone.
- [ ] APS-42 **Recommended** [Treat data from other APIs as untrusted](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/third-party-api-data.md): Check and limit what comes back from partner and third-party APIs, as you would for user input.
- [ ] APS-45 **Recommended** [Unpack archives safely](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/safe-archive-extraction.md): Keep every entry of an uploaded zip or tar file inside the target folder, and stop unpacking at a fixed total size and file count.
- [ ] APS-47 **Recommended** [Keep unkeyed headers from changing cached pages](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/web-cache-poisoning.md): Let a cached reply depend only on the parts of the request in the cache key. Never build a cached page from a header the cache ignores.
- [ ] APS-48 **Recommended** [Make every server agree where a request ends](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/request-smuggling.md): Refuse every request whose length is unclear, so a proxy and the app behind it never read one request as two.
## Limits and business logic
- [ ] APS-49 **Required** [Limit how often anyone can call your APIs](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/rate-limits.md): Put a rate limit on every endpoint that does work for each request, such as APIs, agent endpoints, forms and report collectors.
- [ ] APS-50 **Required** [Take the client address only from proxies you run](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/trusted-proxy-client-address.md): Read the client address from `X-Forwarded-For` or `Forwarded` only when the request came through your own proxy. Take the entry that proxy added, and key every rate limit, ban and log on that one value.
- [ ] APS-51 **Required** [Keep regular expressions from stalling the server](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/regex-denial-of-service.md): Match untrusted input only with a linear-time regular expression engine, or cap the input length before a backtracking engine reads it. Never build a pattern from user input.
- [ ] APS-52 **Required** [Work out every amount on the server](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/server-side-business-rules.md): Never trust a price, quantity, discount or step order sent by the browser. The server works out every amount and checks that each step happened.
- [ ] APS-53 **Required** [Make each change happen exactly once](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/race-conditions.md): Changes to money, stock and single-use items must happen once, even when the same request arrives twice at the same moment.
## Cryptography and keys
- [ ] APS-54 **Required** [Encrypt data on the wire and on disk](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/encrypt-data.md): Encrypt every connection, including those between your own servers. Encrypt stored personal data and backups.
- [ ] APS-102 **Required** [Renew certificates automatically](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/certificate-renewal.md): Renew every certificate automatically, and get an alert when one has under 14 days left.
- [ ] APS-55 **Recommended** [Turn off old encryption](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/tls-configuration.md): Allow only TLS 1.2 and 1.3, with ECDHE key exchange and AEAD ciphers. Turn off TLS compression and 0-RTT for requests that change data.
- [ ] APS-56 **Recommended** [Use only standard cryptography](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/standard-cryptography.md): Encrypt and sign only with current algorithms from a maintained library. Never write your own scheme, and never use ECB mode, MD5 or SHA-1 for security.
- [ ] APS-57 **Recommended** [Keep encryption keys in a key service](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/key-management.md): Encrypt stored data with keys held in a key management service that never hands out the key itself. Rotate each key automatically, and keep the people who manage keys apart from the roles that use them.
- [ ] APS-103 **Recommended** [Wrap data keys with a key-encryption key](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/envelope-encryption.md): Encrypt data with data keys, and store each data key only in wrapped form. A key-encryption key that never leaves the key service or HSM wraps it. Rotate the key-encryption key without decrypting the data.
- [ ] APS-58 **Recommended** [Encrypt the most sensitive fields](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/field-encryption.md): Encrypt fields whose leak would cause serious harm, such as ID numbers or health data, in the app before they reach the database.
- [ ] APS-59 **Recommended** [Prepare your encryption for quantum computers](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/post-quantum-readiness.md): List every use of public-key cryptography, and offer hybrid ML-KEM key exchange on every TLS connection you control. Make each algorithm a setting you can change.
## Secrets and configuration
- [ ] APS-60 **Required** [Keep secrets out of code](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/secrets-out-of-code.md): Never write a password, key or token into code, settings files in the repo, or its history.
- [ ] APS-61 **Required** [Keep secrets out of the browser](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/secrets-out-of-browser.md): Send no private key to the browser. Anything in a page, script or source map can be read by anyone.
- [ ] APS-63 **Required** [Keep storage buckets private](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/private-storage-buckets.md): Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.
- [ ] APS-64 **Required** [Close debug and admin doors](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/close-debug-doors.md): Remove debug, test and status tools from production, or put them behind a login and a private network.
- [ ] APS-62 **Recommended** [Give each key the least power](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/least-privilege-keys.md): Give every key, account and service only the access it needs. Use a separate key for each service and each environment.
- [ ] APS-65 **Recommended** [Serve no hidden files](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/no-hidden-files.md): Serve only the files you meant to publish. Never serve version control folders, settings files, backups or folder listings.
- [ ] APS-66 **Recommended** [Remove defaults and samples](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/remove-defaults.md): Change every default password and remove sample apps, admin consoles and test pages before going live.
- [ ] APS-67 **Recommended** [Keep software current and quiet](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions.md): Keep the system, server and runtime on versions their makers still support. Install their security updates by the deadlines in [fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md). Don't tell visitors which versions you run.
- [ ] APS-68 **Recommended** [Remove DNS records you no longer use](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/dangling-dns.md): Delete every DNS record that points at a server, bucket or hosted service you no longer own, before you give that resource up.
## Supply chain
- [ ] APS-69 **Required** [Lock and audit dependencies](https://agentwranglers.se/playbook/application-security/supply-chain/audit-dependencies.md): Commit a lock file, install from it exactly, and fail the build on known holes in any dependency.
- [ ] APS-74 **Required** [Keep secrets out of builds from strangers](https://agentwranglers.se/playbook/application-security/supply-chain/ci-secrets.md): Never give deploy keys or other secrets to builds that run code from outside contributors. Give each build job only the access it needs.
- [ ] APS-70 **Recommended** [Review every new package](https://agentwranglers.se/playbook/application-security/supply-chain/review-new-packages.md): Check every new dependency before adding it. Attackers publish packages with names close to popular ones, and take over abandoned ones.
- [ ] APS-71 **Recommended** [Keep the dependency tree small](https://agentwranglers.se/playbook/application-security/supply-chain/small-dependency-tree.md): Count every package the app installs, including the dependencies of dependencies. Add a package only when the standard library or a few lines of your own cannot do the job.
- [ ] APS-72 **Recommended** [Wait a few days before taking new releases](https://agentwranglers.se/playbook/application-security/supply-chain/release-cooldown.md): Install a new version of a dependency only after it has been public for at least 7 days. Security fixes you need now may skip the wait.
- [ ] APS-73 **Recommended** [Fetch private packages only from your own registry](https://agentwranglers.se/playbook/application-security/supply-chain/dependency-confusion.md): Install packages with internal names only from your private registry. The public registry must never be able to answer for them.
- [ ] APS-75 **Recommended** [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md): Make a software bill of materials for every release, and sign where and how the build was made.
- [ ] APS-76 **Recommended** [Treat a machine that installed a bad package as breached](https://agentwranglers.se/playbook/application-security/supply-chain/compromised-package-response.md): When a package version you installed is reported malicious, treat every laptop and build server that installed it as breached. Rotate every credential those machines could read.
- [ ] APS-77 **Recommended** [Use models and data from trusted sources](https://agentwranglers.se/playbook/application-security/supply-chain/trusted-model-sources.md): Load models, adapters and training or search data only from sources you have reviewed, pinned by version or hash.
- [ ] APS-104 **Recommended** [Build releases at SLSA Build Level 2 or higher](https://agentwranglers.se/playbook/application-security/supply-chain/slsa-build-level.md): Build every release on a hosted build platform that generates and signs its provenance, which is SLSA Build Level 2. Aim for Build Level 3 for software that other people install.
- [ ] APS-105 **Recommended** [Verify signatures and provenance before you install or deploy](https://agentwranglers.se/playbook/application-security/supply-chain/verify-provenance.md): Check the signature or provenance of every package and container image before it runs, where the publisher offers one. Deploy only images signed by your own build.
- [ ] APS-106 **Recommended** [Say which known holes do not affect you with VEX](https://agentwranglers.se/playbook/application-security/supply-chain/vex.md): A scanner may report a vulnerable package that cannot be exploited in your product. Record a VEX statement for it, with the status not affected and a justification. Suppress findings only through these statements.
## Errors, logs and vulnerabilities
- [ ] APS-78 **Recommended** [Show short errors](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/short-errors.md): Show visitors a short error with a reference number. Keep stack traces, queries and file paths in the server log.
- [ ] APS-79 **Recommended** [Keep private data out of logs and addresses](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/private-data-out-of-logs.md): Never put passwords, tokens, card numbers or personal details in addresses or logs.
- [ ] APS-80 **Recommended** [Log attacks without personal data](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/security-logging.md): Log failed logins, refused access and rate limit hits, and alert on spikes. Keep personal data out of the log.
- [ ] APS-81 **Recommended** [Fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md): Triage every reported vulnerability within 2 working days. Fix a critical one within 7 days, high within 30, medium within 90 and low within 180, or record a dated risk acceptance.
- [ ] APS-107 **Recommended** [Publish a vulnerability disclosure policy](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/disclosure-policy.md): Publish a vulnerability disclosure policy at a fixed address and link it from `security.txt`. It names what is in scope, how to report, how fast you answer, and that you will not take legal action against good-faith research.
- [ ] APS-108 **Recommended** [Keep a security incident runbook and rehearse it](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/security-incident-runbook.md): Keep a runbook for a security breach with scripts that revoke every session, rotate every secret and preserve logs. Run it as a drill on staging at least every 12 months.
## AI features and agents
- [ ] APS-84 **Required** [Break the lethal trifecta](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta.md): Never give one agent all three of private data, untrusted content and a way to send data out. Remove at least one.
- [ ] APS-85 **Required** [Give agent tools the least power they need](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/least-privilege-tools.md): Give the model only the tools its task needs, each with the narrowest rights, acting as the user and never as an administrator.
- [ ] APS-91 **Required** [Run code the model writes in a sandbox](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/sandbox-model-code.md): Run code or commands a model writes only in a throwaway sandbox. It has no secrets, no network and fixed limits on time, memory and disk.
- [ ] APS-82 **Recommended** [Resist direct prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/direct-prompt-injection.md): Assume any user can talk your model into ignoring its instructions. Enforce every limit in code outside the model, never only in the prompt.
- [ ] APS-83 **Recommended** [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md): Treat every page, file, email and tool result the model reads as data that may contain hostile instructions.
- [ ] APS-86 **Recommended** [Treat model output as untrusted](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/untrusted-model-output.md): Handle every model answer like text from a stranger. Escape it before showing it, and never run it as code, SQL or a shell command.
- [ ] APS-87 **Recommended** [Keep secrets out of the system prompt](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/no-secrets-in-prompt.md): Write the system prompt as if it will be published. It holds no keys, passwords, internal addresses or private rules.
- [ ] APS-88 **Recommended** [Protect agent memory](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/memory-poisoning.md): Save to long-term memory only what the user said or approved, and keep each user's memory apart.
- [ ] APS-89 **Recommended** [Send models only the private data they need](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/private-data-to-models.md): Send a model provider only the personal data a task needs, under terms that forbid training on it.
- [ ] APS-90 **Recommended** [Keep a switch that turns the agent off](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/agent-kill-switch.md): Be able to switch off an agent, or one of its tools, for every user at once and without a deploy.
- [ ] APS-92 **Recommended** [Lock local agent servers to your own machine](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/local-server-origin.md): A local MCP server or other agent tool server listens on 127.0.0.1 only. It refuses requests with a foreign `Origin` header and asks for a token.
## Related playbooks
- [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement.md) in the Adversarial testing playbook. Prove each control holds by attacking a staging copy, with written permission and a scope file.
- [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods.md) in the Accounts and identity playbook. Passkeys, passwords and single sign-on decide how people prove who they are. This playbook covers the checks behind them.
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md) in the Infrastructure and environments playbook. Cloud roles, short-lived credentials and networks keep a leaked key or a broken server from reaching everything else.
- [API security](https://agentwranglers.se/playbook/api-design/api-security.md) in the API design playbook. Authentication, scopes and rate limits for every endpoint, in the shape API clients expect.
- [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting.md) in the Compliance and governance playbook. When a control fails, the reporting clocks start. Know who to tell and by when.
## Show the badge on your project
When your project passes every Required rule, you can show this badge on your site or in your README. It links to this checklist, so anyone can run the same checks.
```html
```
```markdown
[](https://agentwranglers.se/playbook/application-security/checklist.md)
```