Purpose
Use this checklist in design reviews before shipping features that touch authentication, payments, personal data, or admin tooling. It is written for product and engineering leads who share responsibility with security — not only for “security tickets”.
Before you write code
Threat model the top journeys
- Map the three highest-value user journeys (for example login, data export, admin impersonation)
- List assets, actors, and abuse goals for each journey
- Decide which risks you accept, mitigate, or transfer — write the owner’s name
Data classification
- Label personal data, secrets, and commercially sensitive fields
- Confirm Hong Kong / regional residency assumptions for storage and logs
- Define retention before the feature ships
Control checklist
- Default-deny for admin and data-export paths
- Least privilege for service accounts and CI runners
- Secrets never in client bundles, mobile apps, or public repos
- Dependency pin + advisory monitoring in CI
- Abuse-case tests for authorisation failures (IDOR, privilege escalation, mass assignment)
- Rate limits and bot resistance on authentication and password-reset flows
- Audit logs for privileged actions with tamper-evident retention
- Backup and restore tested for the new data store
Design review questions
- What happens if a stolen session token is replayed?
- Can a normal user reach another tenant’s object by changing an ID?
- Which third-party SDK receives personal data, and under what contract?
- How do we revoke access within one hour after offboarding?
Evidence for later Trust Review
If your organisation plans an HKISG Trust Review, keep dated screenshots, policy links, and CI job IDs that prove these controls operate — not only that they were discussed. See the Assessment Methodology.
Common failure patterns we still see
- Feature flags that skip authz “temporarily”
- Shared break-glass accounts without logging
- Debug endpoints left open in staging that share production IdP
- Customer support tools that export full datasets without dual control