p: login redirect -> credential capture
- whitelist allowed
p: components with known vulnerabilities
- security checker package
p: cookie passthrough
- user interaction, csrf, no sticky login
p: mssing function access control + insecure object references
- unavoidable acl
p: data exposure
- https everywhere
- password storage
- (or) store no data at all
p: security misconfiguration
- pay an expert
- turn off stack traces in production
p: xss
- escape everything all the time
p: broken auth, session manage
- session use only cookies
- session regeneration
- password confirmation for critical actions
- https + secure cookies + http cookies + csrf + credential entry + session regen
p: injection
- filter everything all the time
- sql parameters
- filter_var