Web App Security Checklist

Create two test users. Copy one user's read request as cURL, replay it in Postman with the other user's record ID. Do you get their data?

Replay the same request as an update. Does their record change?

Replay it as a delete. Is their record gone?

As a normal user, call an admin or privileged endpoint directly. Does the backend reject you?

Change fields like role, owner_id, user_id or workspace_id in a request and send it. Do you now have access you shouldn't?

Sign out completely. Replay a write request with the authorization header removed. Does the backend accept it?

Open DevTools → Network and reload every sensitive page. Do any responses contain records or fields the current user shouldn’t receive?

Inspect request headers, payloads, frontend bundles and browser storage. Can you find any private API key, service credential or secret?

Are you storing sensitive data you don’t actually need?

Replay a request without using the UI. Send missing fields, extra fields, invalid values and oversized input. Does the backend reject them safely?

Upload an invalid or oversized file. Does the backend enforce the same rules as the frontend?

Make a third-party integration fail or timeout in staging. Does your workflow fail safely without leaking internal details?

Repeat a harmless action several times in staging. Do login, AI, email, upload and export actions eventually hit an appropriate limit?

Retry an action that should only happen once. Can it accidentally send two emails, create two payments or run twice?

Trigger a failed login or denied request. Can you find the event in your backend logs without passwords, tokens or secrets being logged?

Change a role, workflow or data model, then rerun the permission tests. Do the same security rules still hold?