Before shipping features handling user data, walk this checklist—security is part of release readiness.
Checklist
- ☐ HTTPS only; HSTS enabled
- ☐ Authn/z on every sensitive endpoint
- ☐ Parameterized queries; output encoding
- ☐ Secrets in vault—not git or client
- ☐ Dependencies scanned; critical CVEs addressed
- ☐ Security logs and alerts configured
- ☐ Backups tested; incident contact documented
- ☐ Privacy: collect minimum data; deletion path exists
Keep learning
Revisit AWS for cloud controls and Generative AI for LLM product risks as features evolve.
Important interview questions and answers
- Q: Definition of done?
A: Security acceptance criteria in user stories. - Q: Threat model when?
A: New features touching auth, payments, PII, or admin.
Self-check
- List five checklist items.
- When run a quick threat model?
Tip: Security is release gate—not a ticket filed after launch only.
Interview prep
- HTTPS only?
Baseline for any user data in transit.