The vibe coder's security checklist
You shipped fast. Here's the whole low-level hygiene list in one place — every item is something a scanner flags and a shakedown email pads with, and every one links to the five-minute fix.
None of this is a red-team exercise. It's the boring layer — config, DNS, and headers — that makes up roughly 80% of what strangers try to shake you down over. Work down the list; it's ordered by impact, so if you only have half an hour, the top three are where it goes.
- 1
Lock down email spoofing
Do this firstNo enforcing DMARC means anyone can send phishing that looks like it's from you. One DNS record. It's the single most common line in a shakedown email.
Read the fix → - 2
Get your secrets off the internet
Do this firstA public .env or browsable .git folder is the one finding that's an actual breach, not just hygiene. Check it in one curl, then rotate anything that leaked.
Read the fix → - 3
Set your security headers
Do this firstHSTS, CSP, X-Frame-Options and friends — the safe ones ship in a single deploy and clear most of what a scanner flags.
Read the fix → - 4
Dress your cookies right
While you're in thereHttpOnly, Secure, and SameSite decide how hard it is to steal a session. Three flags on the cookie you already issue.
Read the fix → - 5
Kill dangling subdomains
While you're in thereA forgotten DNS record pointing at a decommissioned host lets a stranger serve content from your domain. Delete the record or reclaim the resource.
Read the fix → - 6
Make HTTPS actually enforced
While you're in thereA cert isn't the finish line. Force the http→https redirect, kill old TLS versions, chase mixed content, and watch the expiry.
Read the fix → - 7
Harden your DNS
Finishing touchesTurn on DNSSEC so your DNS answers can't be forged, and add a CAA record so only your chosen CAs can issue certs. Mostly a toggle.
Read the fix →
Two things that aren't line items
First, know your enemy: most “critical vulnerability” emails are theater, and it helps to see how the fake bug bounty shakedown works so a scanner screenshot reads as a to-do list, not a threat.
Second, this is a checklist you run more than once. Hygiene drifts — a deploy drops a header, a cert lapses, a subdomain goes orphaned — so “done” is really “done for now.” And if you want to know how you stack up while you work through it, the State of the Swamp numbers show what everyone else is (and isn't) fixing.
The shortcut, of course, is to not check all of this by hand. A scan walks the entire list in about twenty seconds and hands you the fixes — which is the fastest way to turn this page into a green report.
Run the whole checklist at once — findings and fixes, free.
Scan your site free →