yaml 11 lines · 1 tab

Security review checklist for production readiness of new services

Kai Nakamura Apr 2026

1 tab

auth:
  - authentication required for non-public endpoints
  - authorization rules documented and tested
data:
  - secrets stored outside source control
  - encryption in transit enabled
  - sensitive fields redacted from logs
operations:
  - alerts configured for auth failures and 5xx spikes
  - dependency scanning enabled in CI
  - backup and restore path tested

1 file · yaml Explain with highlit

I use a review checklist to make sure basic controls are present before a service ships: auth, logging, secrets, dependency scanning, backups, and least privilege. Checklists do not replace expertise, but they prevent avoidable omissions. The best ones are short enough that people actually use them.

Related snips

ruby

RegistrationSchema = Dry::Schema.Params do
  required(:email).filled(:string, format?: URI::MailTo::EMAIL_REGEXP)
  required(:password).filled(:string, min_size?: 12)
  optional(:marketing_opt_in).filled(:bool)
  optional(:country).filled(:string, included_in?: %w[US CA GB AU])
end

Input validation with allowlists and explicit schemas

input-validation schemas secure-coding

by Kai Nakamura 1 tab

ruby

cookies.encrypted[:trusted_device] = {
  value: { user_id: current_user.id, fingerprint: device_fingerprint }.to_json,
  expires: 30.days.from_now,
  httponly: true,
  secure: Rails.env.production?,
  same_site: :strict,

Signed and encrypted Rails cookies for tamper resistant state

rails cookies encryption

by Kai Nakamura 1 tab

ruby

class Rack::Attack
  throttle('logins/ip', limit: 5, period: 20.seconds) do |request|
    request.ip if request.path == '/users/sign_in' && request.post?
  end

  throttle('password_reset/email', limit: 3, period: 15.minutes) do |request|

Rate limiting abusive clients with Rack::Attack

rate-limiting rack-attack brute-force

by Kai Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

Security review checklist for production readiness of new services — share card

Link copied