team-tryouts/docs/security-checklist.md

Pre-Deployment Security Checklist

Run through this checklist before deploying to production.

Phase 1 — Transport Security

• SSL certificate obtained and installed
• All HTTP requests redirect to HTTPS (301)
• HSTS header present: max-age=31536000; includeSubDomains; preload
• TLS 1.2 minimum, TLS 1.3 preferred
• Strong ciphers configured (no RC4, 3DES, or export-grade)
• OCSP Stapling configured (optional but recommended)

Phase 2 — Production WSGI Server

• Application running via Waitress (not Flask dev server)
• Worker threads: CPU * 2 + 1
• Application bound to 127.0.0.1 (not 0.0.0.0)
• Graceful shutdown configured

Phase 3 — Secure Cookies & Sessions

• SESSION_COOKIE_SECURE = True
• SESSION_COOKIE_HTTPONLY = True
• SESSION_COOKIE_SAMESITE = "Lax"
• Session timeout ≤ 1 hour
• Session regenerated after login
• Session cleared after logout

Phase 5 — Authentication Security

• Passwords hashed with werkzeug/bcrypt (never plain text)
• Password policy enforced (min 8 chars, uppercase, lowercase, digit)
• Account lockout after 5 failed attempts (15 min)
• CAPTCHA on registration form
• Rate limiting on login (10/min) and registration (3/hr)

Phase 6 — CSRF Protection

• CSRF protection enabled (Flask-WTF)
• All POST/PUT/PATCH/DELETE requests protected
• CSRF-exempt routes reviewed and justified

Phase 7 — Input Validation

• All form inputs validated with Marshmallow schemas
• Input whitespace stripped automatically
• Email format validated
• Phone format validated (if provided)
• Discord username format validated (if provided)

Phase 8 — SQL Injection Protection

• All database queries use SQLAlchemy ORM
• No raw SQL with string interpolation
• Parameterized queries used if raw SQL is necessary

Phase 9 — HTTP Security Headers

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy: camera=(), microphone=(), geolocation=()
• Cross-Origin-Opener-Policy: same-origin
• Content-Security-Policy configured
• CSP does not contain unsafe-eval

Phase 10 — CORS

• CORS configured with explicit allowed origins
• No wildcard (*) origin in production
• Only necessary methods exposed
• Credentials support configured properly

Phase 11 — API Security

• All API endpoints require authentication
• Authorization verified per-endpoint (not just authentication)
• Cross-user data access prevented (e.g., Player A cannot view Player B's data)

Phase 12 — File Upload Security

• Upload size limited to 16MB (MAX_CONTENT_LENGTH)
• File extensions restricted to PDF only
• File content validated by parsing with pypdf (PdfReader) — header (%PDF-) + at least one parseable page
• Files stored with UUID filenames (not original names)
• Upload directory outside web root (or Google Drive in production)

Phase 13 — Logging & Monitoring

• Structured logging configured
• Separate logs for errors and auth events
• Sensitive data filtered from logs
• Log rotation configured
• Logs directory secured

Phase 14 — Rate Limiting & Abuse Protection

• Global rate limits configured
• Login: 10 requests/minute
• Registration: 3 requests/hour
• CAPTCHA on registration

Phase 15 — Reverse Proxy Security

• server_tokens off in Nginx
• Request size limits configured
• Buffer size limits configured
• Timeout settings configured
• Real IP forwarding headers set

Phase 16 — Database Security

• Database not accessible from outside
• Least-privilege database user (when using PostgreSQL/MySQL)
• Daily automated backups configured
• Backup restoration tested

Phase 17 — Dependency Security

• All packages pinned to specific versions
• Dependabot configured for automated updates
• pip-audit run with no critical vulnerabilities
• Regular dependency review schedule

Phase 18 — Infrastructure

• Firewall: only ports 80 and 443 open
• Block direct access to application port (5000)
• SSH key authentication only (no password)
• Automatic security updates enabled
• Application running with least privilege

Phase 19 — Flask Best Practices

• DEBUG mode disabled
• Custom error handlers for 400/401/403/404/429/500
• No stack traces exposed in error pages
• Environment variables for all configuration
• Health check endpoint (GET /health) working
• Blueprints used for modular organization

Phase 20 — Deployment & CI/CD

• Code in version control (Git)
• Main branch protected
• CI pipeline running (lint, security scan, tests)
• No secrets committed to repository
• Backup before each deployment

Phase 21 — Final Validation

• Run python security_scan.py --url https://yourdomain.com
• Scan with Mozilla Observatory: https://observatory.mozilla.org/
• Scan with SecurityHeaders.com: https://securityheaders.com/
• Verify all pages redirect correctly to HTTPS
• Check cookies: Secure, HttpOnly, SameSite
• Confirm debug mode is off
• Review initial logs for sensitive data leaks
• Test rate limiting on login and registration
• Test account lockout mechanism
• Test file upload restrictions (non-PDF should fail)

---

Date Validated: _______________

Validated By: _______________

Notes: _______________