Project: Secure Service Checklist

Project: Secure Service Checklist

Overview

Take any small HTTP service (Bookstore or echo) and harden it against a checklist. Tick items with code or config evidence.

Transport & process

• TLS in production path (or documented edge termination)
  
• ReadHeaderTimeout set on http.Server
  
• Non-root container user
  
• Graceful shutdown

Authn / authz

• Auth on mutating routes
  
• Password hashing (bcrypt/argon2) if local auth
  
• JWT: alg allowlist + exp + aud (if used)
  
• CSRF strategy documented for cookie sessions

Input / output

• MaxBytesReader on bodies
  
• Path jail for file ops
  
• No SSRF open URL fetch
  
• Security headers (or edge config)

Secrets & deps

• Secrets not in git
  
• govulncheck clean or waived
  
• Structured logs without secrets

Deliverable

SECURITY.md in the project with checklist status + residual risks.