Authentication
- One-time wallet challenges
- Short challenge expiration
- Signature verification
- Session revocation
- Secure cookies before production
Credentials
- Deterministic serialization
- Key versioning
- Signature verification
- Credential hash
- Tamper detection
- Expiration enforcement
API
- Rate limiting
- Request size limits
- Input validation
- API key hashing
- Webhook signing
- Idempotency keys
- Abuse monitoring
Infrastructure
- Secret management
- Least-privilege database users
- Dependency scanning
- Container scanning
- Backup strategy
- Incident response process
Contracts
- Authorization checks
- Duplicate prevention
- Status transition tests
- Emergency pause
- Independent review before mainnet