SeeCureApp Security Checklist

Use UUID instead of using numerical IDs on your API.

Make sure that your API is being protected against rate limit attacks ("Login page, PIN Codes, etc")

Encrypt all traffic and make sure that all API endpoints is being called using HTTPS

Be careful not to incidentally reveal detailed technical information in the error description that might help a potential attacker.

Implement CSRF token header to prevent cross-site request forgery attacks

Implement CSP header to prevent XSS attacks

Implement HSTS header to prevent SSL Downgrade attack

Implement X-Frame-Options header with its deny to protect against your website against Clickjacking attack

Implement HTTP Public Key Pinning header if you're loading JavaScript libraries from external CDN

Implement X-Content-Type-Options header to protect your app from MIME-sniffing attacks

Implement Referrer-Policy header to prevent your domain from leaking sensitive URLs etc

Make sure that your CORS header is being configured correctly

Avoid calling API endpoints using this way /payment/cards/192812 - Use own resources like /payment/cards/me instead

Set your cookies with Http Only, Secure flags to prevent XSS exploitation

Don't perform any authentication or authorization actions using plaintext base64 ("Reset password tokens, Secret data, etc")

Stop storing your passwords using MD5, Please!

Never expose sensitive data on GET requests ("Credit cards, API keys, passwords, etc")

JWT are good, Use them in your authorization layer If they are suitable in your environment

Make sure that the server backend side is validating your current CSRF header

Set an expiration time on the reset password token for a reasonable period

Make sure that your reset password token can't be used more than a once

Change the email feature should be accompanied by entering the current user password

Setup an API motioning software to identify any malicious threads

Setup a good WAF to protect your app from ("DDOS, SQLI, XSS, etc")