A security hygiene checklist for developers
- Never commit secrets – use environment variables or a secrets manager.
- Turn on multi-factor authentication for Git, cloud and email accounts.
- Use parameterised queries everywhere; never build SQL with string concatenation.
- Escape output in templates to prevent XSS.
- Keep dependencies updated and enable automated vulnerability alerts.
- Give services the least privilege they need.
- Log authentication events and alert on unusual spikes.
- Hash passwords with a slow algorithm such as bcrypt or Argon2.
- Use HTTPS everywhere, including internal services.
- Back up data and actually test restores.
Feedback & comments (2)
Sneha Iyer
Exactly what I needed for my placement preparation.
Rohan Gupta
Bookmarked. The explanations are simpler than most tutorials I have read.