Nothing in this post is clever. All of it is what actually gets found when someone looks properly.
The baseline
- Authorisation enforced at the data layer, not only in the interface. If a rule exists only in the front end, it does not exist.
- Every row of user data reachable only through a policy that names who may read it.
- Secrets in a secret store, never in the repository, never in a client bundle.
- Personal data collected only where there is a reason, with a retention period and an automated sweep that enforces it.
- File uploads validated by type and size, stored privately, served through signed, expiring links.
- Rate limits on anything unauthenticated that writes.
The three recurring findings
Client-side authorisation. An admin panel hidden by a conditional render, with the endpoints wide open behind it.
Over-permissive service credentials. One key with full access used by everything, including code paths that only need to read.
Data with no expiry. Contact forms and logs that quietly accumulate personal data for years because nobody chose a retention period.
Most breaches we read about are not exotic. They are a missing check on an endpoint nobody thought was interesting.
Making it stick
The checks belong in the pull request template and in the deployment gate, not in a document. A rule that depends on remembering is a rule that lasts about six weeks.