Security Audit Checklist
Commercial-ready checklist for pre-launch or quarterly hardening reviews.
Open Security Posture Workflow- Verify mandatory response headers with the Security Headers Checker.
- Generate and test policy with the CSP Generator.
- Validate token structure and expiry claims using the JWT Decoder.
- Confirm session and anti-CSRF controls using the Session Cookie Auditor and CSRF Token Policy Checker.
- Review integrity hashes for third-party assets with the SRI Generator.
When to use this checklist
Use it before major launches, during periodic hardening reviews, or after platform-level changes to proxies, identity flows, or session configuration.
- It works best when engineering and security review the same release candidate.
- It is also useful after CDN, auth-provider, or reverse-proxy changes.
- Turn failed checks into tracked remediation items rather than one-off notes.