--- title: "The 20 rules to check first ยท Agent Wranglers" url: https://agentwranglers.se/playbook/start updated: 2026-10-21 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # The 20 rules to check first For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Playbook](https://agentwranglers.se/playbook.md). These 20 rules catch the problems we find most often in apps built with AI. Check them first, then read the playbook your project needs. They are also in [start.json](https://agentwranglers.se/playbook/start.json). - AID-36 [Keep secret keys on the server](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/server-side-keys): Never ship a secret key in code that runs in the browser. That covers database secret or service role keys, payment secrets and AI provider keys. - SEC-33 [Keep secrets out of code](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code): Never write a password, key or token into code, settings files in the repo, or its history. - AID-35 [Turn on row-level security for every table](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/row-level-security): When the browser talks to the database directly, turn on row-level security for every table and write a policy for each action. - SEC-42 [Keep storage buckets private](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-storage-buckets): Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders. - SEC-17 [Check ownership on every record](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/object-access): Before returning or changing a record, check on the server that it belongs to the logged-in user or their team. - SEC-18 [Check roles on every action](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/function-access): Check the user's role on the server for every admin or staff action. Hiding a button is not a check. - AID-37 [Check every sign-in and permission flow](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/check-auth-flows): Test sign-up, sign-in, password reset and every admin page as a stranger and as a normal user before launch. - SEC-21 [Store passwords with a slow hash](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-storage): Store passwords only as a slow, salted hash made for passwords, such as Argon2id or bcrypt. - SEC-20 [Slow down password guessing](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing): Limit failed logins per account and per address, and refuse passwords known from breaches. - SEC-22 [Lock down session cookies](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies): Mark session cookies `HttpOnly`, `Secure` and `SameSite=Lax` or `Strict`. Issue a new session at login and end it at logout, after idle time and after a fixed lifetime. - SEC-9 [Use parameterised queries](https://agentwranglers.se/playbook/adversarial-testing/injection/sql-injection): Send every database query with placeholders, and pass user input as separate values. Never build a query by joining strings. - SEC-10 [Escape everything you show](https://agentwranglers.se/playbook/adversarial-testing/injection/cross-site-scripting): Escape untrusted text for the place it lands in a page, and back it up with a strict Content Security Policy. - API-51 [Sign every webhook](https://agentwranglers.se/playbook/api-design/webhooks-and-events/signed-webhooks): Sign each webhook body with a secret shared with the receiver, and include a timestamp, so receivers can reject fakes and replays. - PAY-18 [Let provider events move the order](https://agentwranglers.se/playbook/payments/payment-events-and-reconciliation/events-drive-fulfilment): Fulfil, grant access or mark a refund only when a verified provider event or API read says the money moved. Map each event type to one order transition. - PAY-5 [Keep test and live modes apart](https://agentwranglers.se/playbook/payments/checkout-and-card-data/test-and-live-keys): Use the provider's test mode in every environment except production, and make the app refuse to start with a live key anywhere else. - SEC-36 [Close debug and admin doors](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/close-debug-doors): Remove debug, test and status tools from production, or put them behind a login and a private network. - WEB-139 [Make browsers always use HTTPS](https://agentwranglers.se/playbook/website/security/hsts): Send `Strict-Transport-Security` so browsers always use HTTPS. Give it a long `max-age` (at least a year) and `includeSubDomains`, on HTTPS responses only. - SEC-65 [Lock and audit dependencies](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies): Commit a lock file, install from it exactly, and fail the build on known holes in any dependency. - DAT-28 [Prove restores work](https://agentwranglers.se/playbook/data/backups-and-recovery/restore-tests): Restore a backup on a schedule and check the result. An untested backup is a hope, not a backup. - OPS-45 [Back up off the machine](https://agentwranglers.se/playbook/operations/disaster-recovery/off-site-backups): Copy backups automatically to storage in another place, which an attacker on the server cannot delete. **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers playbook`. In code you write, add a comment next to it with the same link.