security-checklist

MONOPOLY — Security Hardening Checklist

When to Use

• Use this skill when the task matches this description: Reference document for monopoly security-checklist.

Network Security

• [ ] All services inside private VPC; only LB/API GW exposed publicly
• [ ] Security groups follow least-privilege (deny all, allow specific ports/CIDRs)
• [ ] NACLs as secondary defense layer
• [ ] WAF enabled with OWASP top 10 ruleset
• [ ] DDoS protection (Cloudflare / AWS Shield Standard minimum)
• [ ] VPN or Private Link for inter-service communication in multi-region

Authentication & Authorization

• [ ] JWT tokens with short expiry (15 min access, 7 day refresh)
• [ ] OAuth 2.0 / OIDC for third-party auth
• [ ] MFA enforced for admin accounts
• [ ] RBAC or ABAC for authorization
• [ ] No secrets in JWT payload (use opaque references)
• [ ] Token revocation strategy (Redis blocklist or short TTL)

API Security

• [ ] Rate limiting at API gateway (per user, per IP, per endpoint)
• [ ] Input validation and sanitization on all endpoints
• [ ] SQL injection prevention (parameterized queries, ORM)
• [ ] XSS prevention (output encoding, CSP headers)
• [ ] CSRF protection (SameSite cookies, CSRF tokens)
• [ ] CORS policy locked down (not wildcard *)
• [ ] HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options)

Data Security

• [ ] Encryption in transit (TLS 1.2+ everyw