Production Engineering Runbook
Enterprise Web Security & Hardening Checklist
A comprehensive security protocol for engineering teams to audit web applications, APIs, database credentials, and cloud deployments against modern vulnerabilities.
Runbook Progress
0 of 7 Completed(0%)
Authentication & SessionCritical
Multi-factor authentication (2FA) enforced on all administrative access
Time-based OTP (TOTP) or WebAuthn passkeys required for all staff logins.
Authentication & SessionCritical
Session tokens stored in secure, HttpOnly, SameSite cookies
Prevents client-side JavaScript access to authentication secrets via XSS.
API & Input ValidationCritical
Parameterized database queries via ORM (Prisma) preventing SQL injection
Zero raw string concatenations in database query pipelines.
API & Input ValidationCritical
Request body payloads validated against strict TypeScript/Zod schemas
Rejects unexpected keys, type casting attacks, and malicious JSON shapes.
Network & CloudCritical
Cloudflare WAF active with automated DDoS mitigation rules
Filters malicious scraping bots, bad user-agents, and Layer 7 volumetric floods.
Network & CloudCritical
Automated off-site database backups with verified restore test
Encrypted backups saved daily with a documented 1-hour recovery time objective.
Secrets ManagementCritical
Zero API keys or secrets committed to git repositories
Pre-commit hooks and GitGuardian scanning active on all engineering branches.