The Audit
A client required SOC 2 compliance.
We had an audit. It wasn't pretty.
Here's the checklist we now use.
Authentication
- Password hashing (bcrypt, not MD5)
- Password requirements enforced
- Rate limiting on login
- Account lockout after failures
- Session timeout
Authorization
- Users can only access their data
- Role-based access control
- Admin actions require verification
- API keys properly scoped
Data Protection
- HTTPS everywhere
- Database encryption at rest
- Sensitive data encrypted
- No secrets in code
- Environment variables for config
Input Validation
- All user input validated
- SQL injection prevented
- XSS prevented
- CSRF tokens on forms
- File upload validation
Monitoring
- Failed login attempts logged
- Admin actions logged
- Error monitoring (Sentry)
- Uptime monitoring
- Alerting for anomalies
Compliance
- GDPR if EU users
- Data export capability
- Data deletion capability
- Privacy policy
- Terms of service
The Honest Take
Security isn't optional.
Build it in. Audit it.
It's cheaper to fix early.
