The pre-launch security checklist we run on every new web app, organised by the OWASP Top 10:2025 categories: authorization tests, injection, secrets, headers and CSP, supply chain, error handling and logging, each with a concrete check you can automate.
Our comment system rendered Markdown and stripped script tags, yet a link with a javascript: URL survived into the page. We fixed it by sanitizing the rendered HTML with an allowlist of tags, attributes and URL schemes, and backed it with a strict Content-Security-Policy.
Our PayPal checkout button rendered in development and staging but was an empty box in production. A new Content-Security-Policy set in Nginx blocked the PayPal SDK script, its iframes and its API calls. We fixed it per directive, with a nonce and a report-only rollout.