Skip to content
BranchesTags

Latest commit

History

45 Commits

Folders and files

NameName
Last commit message
Last commit date
categories
categories
config
config
docs
docs
site
site
README.md
README.md
manifest.json
manifest.json

Repository files navigation

Security Checklists

Open-source security testing checklists for real engagements - web, cloud, mobile, AI, API, Kubernetes, Active Directory, and more.

Use them interactively on the site, or read / fork them here as Markdown.

Open the interactive hub · browse Markdown

SecurityCipher Security Checklists Hub - 18 categories and 1,760+ controls

Start here (for humans)

GoalWhere to go
Track progress in a browsersecuritycipher.com/security-checklists
Read / edit a checklist offlinecategories/*.md
See the category indexconfig/manifest.json

The interactive hub keeps Pass / Fail / N/A status and notes in your browser only. Export Markdown or CSV when you need a report artifact.

Web Application Security checklist detail with filters and progress

Expanded control with how-to-find and how-to-fix guidance

What's inside

  • 18 live categories
  • 1,760+ controls
  • Severity tags, tools, how-to-find / how-to-fix guidance, and references
  • Source format is Markdown so GitHub, editors, and LLMs can all read it cleanly

Categories

ChecklistFile
Web Application Securitycategories/web.md
Mobile Application Securitycategories/mobile.md
AWS Cloud Securitycategories/aws.md
Azure Cloud Securitycategories/azure.md
Google Cloud Platformcategories/gcp.md
LLM and AI Securitycategories/llm.md
MCP Server Securitycategories/mcp.md
AI Agent Securitycategories/agent-security.md
API Securitycategories/api.md
Kubernetes and Containerscategories/kubernetes.md
Cloud Security (Multi-Provider)categories/cloud.md
Active Directory Securitycategories/active-directory.md
Network Securitycategories/network.md
DevSecOps and CI/CDcategories/devsecops.md
OSINT and Reconnaissancecategories/osint.md
Infrastructure and Host Securitycategories/infrastructure.md
CI/CD Pipeline Securitycategories/cicd.md
Secure Code Reviewcategories/secure-code-review.md

Repo layout

categories/ # The checklists (Markdown - start here)
config/
manifest.json # Hub index (titles, colors, file paths)
manifest.json # Same index at repo root for raw GitHub clients
docs/
screenshots/ # README screenshots from the live hub
legacy/ # Older human-readable notes
site/
resource-pages.json # Companion content used by securitycipher.com

This repository is meant to stand alone. The website renders the same Markdown for the interactive UI. You do not need WordPress to use the checklists.

Markdown control format

---id: apititle: API Security---# API Security## Authentication and Authorization### Broken object level authorization (BOLA/IDOR)**Severity:**`high`#### Description
Swap object IDs across users and roles; test horizontal and vertical access.
#### How to find
...
#### How to fix
...
#### Tools- Burp Suite
- Postman
#### References-[OWASP API Security Top 10](https://owasp.org/www-project-api-security/)

Required fields per control: title, severity, description, how_to_find, how_to_fix, tools.

Contribute

  1. Edit or add a file under categories/.
  2. If you add a new domain, register it in config/manifest.json.
  3. Keep severity values as critical, high, medium, low, or info.
  4. Prefer concrete testing steps over vague advice.

Related

LinkWhat it is
Interactive hubTrackable UI on SecurityCipher
awsome-websecurity-checklistExtra web testing notes
awsome-security-mindmapsSecurity mind maps

License / credit

Built and maintained by SecurityCipher. Contributions welcome.

About

securitycipher.com/security-checklist

Topics

active-directoryai-securityapi-securitybug-bountychecklistcloud-securitycybersecurityinfoseckubernetesmobile-securityowasppenetration-testingpentestingsecurity-checklistsecuritycipherweb-security

Resources

Readme
Activity

Stars

5 stars

Watchers

1 watching

Forks

1 fork
Report repository

Releases

Packages

Contributors

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
GitHub - securitycipher/security-checklists · GitHub
Skip to content
BranchesTags
Latest commit
History
45 Commits
Folders and files
NameName
Last commit message
Last commit date
categories
categories
config
config
docs
docs
site
site
README.md
README.md
manifest.json
manifest.json
Repository files navigation
Security Checklists
Open-source security testing checklists for real engagements - web, cloud, mobile, AI, API, Kubernetes, Active Directory, and more.
Use them interactively on the site, or read / fork them here as Markdown.
Open the interactive hub
· browse Markdown
SecurityCipher Security Checklists Hub - 18 categories and 1,760+ controls
Start here (for humans)
GoalWhere to go
Track progress in a browsersecuritycipher.com/security-checklists
Read / edit a checklist offlinecategories/*.md
See the category indexconfig/manifest.json
The interactive hub keeps Pass / Fail / N/A status and notes in your browser only. Export Markdown or CSV when you need a report artifact.
Web Application Security checklist detail with filters and progress
Expanded control with how-to-find and how-to-fix guidance
What's inside
  • 18 live categories
  • 1,760+ controls
  • Severity tags, tools, how-to-find / how-to-fix guidance, and references
  • Source format is Markdown so GitHub, editors, and LLMs can all read it cleanly
Categories
ChecklistFile
Web Application Securitycategories/web.md
Mobile Application Securitycategories/mobile.md
AWS Cloud Securitycategories/aws.md
Azure Cloud Securitycategories/azure.md
Google Cloud Platformcategories/gcp.md
LLM and AI Securitycategories/llm.md
MCP Server Securitycategories/mcp.md
AI Agent Securitycategories/agent-security.md
API Securitycategories/api.md
Kubernetes and Containerscategories/kubernetes.md
Cloud Security (Multi-Provider)categories/cloud.md
Active Directory Securitycategories/active-directory.md
Network Securitycategories/network.md
DevSecOps and CI/CDcategories/devsecops.md
OSINT and Reconnaissancecategories/osint.md
Infrastructure and Host Securitycategories/infrastructure.md
CI/CD Pipeline Securitycategories/cicd.md
Secure Code Reviewcategories/secure-code-review.md
Repo layout
categories/ # The checklists (Markdown - start here)
config/
manifest.json # Hub index (titles, colors, file paths)
manifest.json # Same index at repo root for raw GitHub clients
docs/
screenshots/ # README screenshots from the live hub
legacy/ # Older human-readable notes
site/
resource-pages.json # Companion content used by securitycipher.com

This repository is meant to stand alone. The website renders the same Markdown for the interactive UI. You do not need WordPress to use the checklists.
Markdown control format
---id: apititle: API Security---# API Security## Authentication and Authorization### Broken object level authorization (BOLA/IDOR)**Severity:**`high`#### Description
Swap object IDs across users and roles; test horizontal and vertical access.
#### How to find
...
#### How to fix
...
#### Tools- Burp Suite
- Postman
#### References-[OWASP API Security Top 10](https://owasp.org/www-project-api-security/)
Required fields per control: title, severity, description, how_to_find, how_to_fix, tools.
Contribute
  1. Edit or add a file under categories/.
  2. If you add a new domain, register it in config/manifest.json.
  3. Keep severity values as critical, high, medium, low, or info.
  4. Prefer concrete testing steps over vague advice.
Related
LinkWhat it is
Interactive hubTrackable UI on SecurityCipher
awsome-websecurity-checklistExtra web testing notes
awsome-security-mindmapsSecurity mind maps
License / credit
Built and maintained by SecurityCipher. Contributions welcome.
About
securitycipher.com/security-checklist
Topics
active-directoryai-securityapi-securitybug-bountychecklistcloud-securitycybersecurityinfoseckubernetesmobile-securityowasppenetration-testingpentestingsecurity-checklistsecuritycipherweb-security
Resources
Readme
Activity
Stars
5 stars
Watchers
1 watching
Forks
1 fork
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
GitHub - securitycipher/security-checklists · GitHub
Skip to content
BranchesTags
Latest commit
History
45 Commits
Folders and files
NameName
Last commit message
Last commit date
categories
categories
config
config
docs
docs
site
site
README.md
README.md
manifest.json
manifest.json
Repository files navigation
Security Checklists
Open-source security testing checklists for real engagements - web, cloud, mobile, AI, API, Kubernetes, Active Directory, and more.
Use them interactively on the site, or read / fork them here as Markdown.
Open the interactive hub
· browse Markdown
SecurityCipher Security Checklists Hub - 18 categories and 1,760+ controls
Start here (for humans)
GoalWhere to go
Track progress in a browsersecuritycipher.com/security-checklists
Read / edit a checklist offlinecategories/*.md
See the category indexconfig/manifest.json
The interactive hub keeps Pass / Fail / N/A status and notes in your browser only. Export Markdown or CSV when you need a report artifact.
Web Application Security checklist detail with filters and progress
Expanded control with how-to-find and how-to-fix guidance
What's inside
  • 18 live categories
  • 1,760+ controls
  • Severity tags, tools, how-to-find / how-to-fix guidance, and references
  • Source format is Markdown so GitHub, editors, and LLMs can all read it cleanly
Categories
ChecklistFile
Web Application Securitycategories/web.md
Mobile Application Securitycategories/mobile.md
AWS Cloud Securitycategories/aws.md
Azure Cloud Securitycategories/azure.md
Google Cloud Platformcategories/gcp.md
LLM and AI Securitycategories/llm.md
MCP Server Securitycategories/mcp.md
AI Agent Securitycategories/agent-security.md
API Securitycategories/api.md
Kubernetes and Containerscategories/kubernetes.md
Cloud Security (Multi-Provider)categories/cloud.md
Active Directory Securitycategories/active-directory.md
Network Securitycategories/network.md
DevSecOps and CI/CDcategories/devsecops.md
OSINT and Reconnaissancecategories/osint.md
Infrastructure and Host Securitycategories/infrastructure.md
CI/CD Pipeline Securitycategories/cicd.md
Secure Code Reviewcategories/secure-code-review.md
Repo layout
categories/ # The checklists (Markdown - start here)
config/
manifest.json # Hub index (titles, colors, file paths)
manifest.json # Same index at repo root for raw GitHub clients
docs/
screenshots/ # README screenshots from the live hub
legacy/ # Older human-readable notes
site/
resource-pages.json # Companion content used by securitycipher.com

This repository is meant to stand alone. The website renders the same Markdown for the interactive UI. You do not need WordPress to use the checklists.
Markdown control format
---id: apititle: API Security---# API Security## Authentication and Authorization### Broken object level authorization (BOLA/IDOR)**Severity:**`high`#### Description
Swap object IDs across users and roles; test horizontal and vertical access.
#### How to find
...
#### How to fix
...
#### Tools- Burp Suite
- Postman
#### References-[OWASP API Security Top 10](https://owasp.org/www-project-api-security/)
Required fields per control: title, severity, description, how_to_find, how_to_fix, tools.
Contribute
  1. Edit or add a file under categories/.
  2. If you add a new domain, register it in config/manifest.json.
  3. Keep severity values as critical, high, medium, low, or info.
  4. Prefer concrete testing steps over vague advice.
Related
LinkWhat it is
Interactive hubTrackable UI on SecurityCipher
awsome-websecurity-checklistExtra web testing notes
awsome-security-mindmapsSecurity mind maps
License / credit
Built and maintained by SecurityCipher. Contributions welcome.
About
securitycipher.com/security-checklist
Topics
active-directoryai-securityapi-securitybug-bountychecklistcloud-securitycybersecurityinfoseckubernetesmobile-securityowasppenetration-testingpentestingsecurity-checklistsecuritycipherweb-security
Resources
Readme
Activity
Stars
5 stars
Watchers
1 watching
Forks
1 fork
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
GitHub - securitycipher/security-checklists · GitHub
Skip to content
BranchesTags
Latest commit
History
45 Commits
Folders and files
NameName
Last commit message
Last commit date
categories
categories
config
config
docs
docs
site
site
README.md
README.md
manifest.json
manifest.json
Repository files navigation
Security Checklists
Open-source security testing checklists for real engagements - web, cloud, mobile, AI, API, Kubernetes, Active Directory, and more.
Use them interactively on the site, or read / fork them here as Markdown.
Open the interactive hub
· browse Markdown
SecurityCipher Security Checklists Hub - 18 categories and 1,760+ controls
Start here (for humans)
GoalWhere to go
Track progress in a browsersecuritycipher.com/security-checklists
Read / edit a checklist offlinecategories/*.md
See the category indexconfig/manifest.json
The interactive hub keeps Pass / Fail / N/A status and notes in your browser only. Export Markdown or CSV when you need a report artifact.
Web Application Security checklist detail with filters and progress
Expanded control with how-to-find and how-to-fix guidance
What's inside
  • 18 live categories
  • 1,760+ controls
  • Severity tags, tools, how-to-find / how-to-fix guidance, and references
  • Source format is Markdown so GitHub, editors, and LLMs can all read it cleanly
Categories
ChecklistFile
Web Application Securitycategories/web.md
Mobile Application Securitycategories/mobile.md
AWS Cloud Securitycategories/aws.md
Azure Cloud Securitycategories/azure.md
Google Cloud Platformcategories/gcp.md
LLM and AI Securitycategories/llm.md
MCP Server Securitycategories/mcp.md
AI Agent Securitycategories/agent-security.md
API Securitycategories/api.md
Kubernetes and Containerscategories/kubernetes.md
Cloud Security (Multi-Provider)categories/cloud.md
Active Directory Securitycategories/active-directory.md
Network Securitycategories/network.md
DevSecOps and CI/CDcategories/devsecops.md
OSINT and Reconnaissancecategories/osint.md
Infrastructure and Host Securitycategories/infrastructure.md
CI/CD Pipeline Securitycategories/cicd.md
Secure Code Reviewcategories/secure-code-review.md
Repo layout
categories/ # The checklists (Markdown - start here)
config/
manifest.json # Hub index (titles, colors, file paths)
manifest.json # Same index at repo root for raw GitHub clients
docs/
screenshots/ # README screenshots from the live hub
legacy/ # Older human-readable notes
site/
resource-pages.json # Companion content used by securitycipher.com

This repository is meant to stand alone. The website renders the same Markdown for the interactive UI. You do not need WordPress to use the checklists.
Markdown control format
---id: apititle: API Security---# API Security## Authentication and Authorization### Broken object level authorization (BOLA/IDOR)**Severity:**`high`#### Description
Swap object IDs across users and roles; test horizontal and vertical access.
#### How to find
...
#### How to fix
...
#### Tools- Burp Suite
- Postman
#### References-[OWASP API Security Top 10](https://owasp.org/www-project-api-security/)
Required fields per control: title, severity, description, how_to_find, how_to_fix, tools.
Contribute
  1. Edit or add a file under categories/.
  2. If you add a new domain, register it in config/manifest.json.
  3. Keep severity values as critical, high, medium, low, or info.
  4. Prefer concrete testing steps over vague advice.
Related
LinkWhat it is
Interactive hubTrackable UI on SecurityCipher
awsome-websecurity-checklistExtra web testing notes
awsome-security-mindmapsSecurity mind maps
License / credit
Built and maintained by SecurityCipher. Contributions welcome.
About
securitycipher.com/security-checklist
Topics
active-directoryai-securityapi-securitybug-bountychecklistcloud-securitycybersecurityinfoseckubernetesmobile-securityowasppenetration-testingpentestingsecurity-checklistsecuritycipherweb-security
Resources
Readme
Activity
Stars
5 stars
Watchers
1 watching
Forks
1 fork
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
GitHub - securitycipher/security-checklists · GitHub
Skip to content
BranchesTags
Latest commit
History
45 Commits
Folders and files
NameName
Last commit message
Last commit date
categories
categories
config
config
docs
docs
site
site
README.md
README.md
manifest.json
manifest.json
Repository files navigation
Security Checklists
Open-source security testing checklists for real engagements - web, cloud, mobile, AI, API, Kubernetes, Active Directory, and more.
Use them interactively on the site, or read / fork them here as Markdown.
Open the interactive hub
· browse Markdown
SecurityCipher Security Checklists Hub - 18 categories and 1,760+ controls
Start here (for humans)
GoalWhere to go
Track progress in a browsersecuritycipher.com/security-checklists
Read / edit a checklist offlinecategories/*.md
See the category indexconfig/manifest.json
The interactive hub keeps Pass / Fail / N/A status and notes in your browser only. Export Markdown or CSV when you need a report artifact.
Web Application Security checklist detail with filters and progress
Expanded control with how-to-find and how-to-fix guidance
What's inside
  • 18 live categories
  • 1,760+ controls
  • Severity tags, tools, how-to-find / how-to-fix guidance, and references
  • Source format is Markdown so GitHub, editors, and LLMs can all read it cleanly
Categories
ChecklistFile
Web Application Securitycategories/web.md
Mobile Application Securitycategories/mobile.md
AWS Cloud Securitycategories/aws.md
Azure Cloud Securitycategories/azure.md
Google Cloud Platformcategories/gcp.md
LLM and AI Securitycategories/llm.md
MCP Server Securitycategories/mcp.md
AI Agent Securitycategories/agent-security.md
API Securitycategories/api.md
Kubernetes and Containerscategories/kubernetes.md
Cloud Security (Multi-Provider)categories/cloud.md
Active Directory Securitycategories/active-directory.md
Network Securitycategories/network.md
DevSecOps and CI/CDcategories/devsecops.md
OSINT and Reconnaissancecategories/osint.md
Infrastructure and Host Securitycategories/infrastructure.md
CI/CD Pipeline Securitycategories/cicd.md
Secure Code Reviewcategories/secure-code-review.md
Repo layout
categories/ # The checklists (Markdown - start here)
config/
manifest.json # Hub index (titles, colors, file paths)
manifest.json # Same index at repo root for raw GitHub clients
docs/
screenshots/ # README screenshots from the live hub
legacy/ # Older human-readable notes
site/
resource-pages.json # Companion content used by securitycipher.com

This repository is meant to stand alone. The website renders the same Markdown for the interactive UI. You do not need WordPress to use the checklists.
Markdown control format
---id: apititle: API Security---# API Security## Authentication and Authorization### Broken object level authorization (BOLA/IDOR)**Severity:**`high`#### Description
Swap object IDs across users and roles; test horizontal and vertical access.
#### How to find
...
#### How to fix
...
#### Tools- Burp Suite
- Postman
#### References-[OWASP API Security Top 10](https://owasp.org/www-project-api-security/)
Required fields per control: title, severity, description, how_to_find, how_to_fix, tools.
Contribute
  1. Edit or add a file under categories/.
  2. If you add a new domain, register it in config/manifest.json.
  3. Keep severity values as critical, high, medium, low, or info.
  4. Prefer concrete testing steps over vague advice.
Related
LinkWhat it is
Interactive hubTrackable UI on SecurityCipher
awsome-websecurity-checklistExtra web testing notes
awsome-security-mindmapsSecurity mind maps
License / credit
Built and maintained by SecurityCipher. Contributions welcome.
About
securitycipher.com/security-checklist
Topics
active-directoryai-securityapi-securitybug-bountychecklistcloud-securitycybersecurityinfoseckubernetesmobile-securityowasppenetration-testingpentestingsecurity-checklistsecuritycipherweb-security
Resources
Readme
Activity
Stars
5 stars
Watchers
1 watching
Forks
1 fork
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
GitHub - securitycipher/security-checklists · GitHub
Skip to content
BranchesTags
Latest commit
History
45 Commits
Folders and files
NameName
Last commit message
Last commit date
categories
categories
config
config
docs
docs
site
site
README.md
README.md
manifest.json
manifest.json
Repository files navigation
Security Checklists
Open-source security testing checklists for real engagements - web, cloud, mobile, AI, API, Kubernetes, Active Directory, and more.
Use them interactively on the site, or read / fork them here as Markdown.
Open the interactive hub
· browse Markdown
SecurityCipher Security Checklists Hub - 18 categories and 1,760+ controls
Start here (for humans)
GoalWhere to go
Track progress in a browsersecuritycipher.com/security-checklists
Read / edit a checklist offlinecategories/*.md
See the category indexconfig/manifest.json
The interactive hub keeps Pass / Fail / N/A status and notes in your browser only. Export Markdown or CSV when you need a report artifact.
Web Application Security checklist detail with filters and progress
Expanded control with how-to-find and how-to-fix guidance
What's inside
  • 18 live categories
  • 1,760+ controls
  • Severity tags, tools, how-to-find / how-to-fix guidance, and references
  • Source format is Markdown so GitHub, editors, and LLMs can all read it cleanly
Categories
ChecklistFile
Web Application Securitycategories/web.md
Mobile Application Securitycategories/mobile.md
AWS Cloud Securitycategories/aws.md
Azure Cloud Securitycategories/azure.md
Google Cloud Platformcategories/gcp.md
LLM and AI Securitycategories/llm.md
MCP Server Securitycategories/mcp.md
AI Agent Securitycategories/agent-security.md
API Securitycategories/api.md
Kubernetes and Containerscategories/kubernetes.md
Cloud Security (Multi-Provider)categories/cloud.md
Active Directory Securitycategories/active-directory.md
Network Securitycategories/network.md
DevSecOps and CI/CDcategories/devsecops.md
OSINT and Reconnaissancecategories/osint.md
Infrastructure and Host Securitycategories/infrastructure.md
CI/CD Pipeline Securitycategories/cicd.md
Secure Code Reviewcategories/secure-code-review.md
Repo layout
categories/ # The checklists (Markdown - start here)
config/
manifest.json # Hub index (titles, colors, file paths)
manifest.json # Same index at repo root for raw GitHub clients
docs/
screenshots/ # README screenshots from the live hub
legacy/ # Older human-readable notes
site/
resource-pages.json # Companion content used by securitycipher.com

This repository is meant to stand alone. The website renders the same Markdown for the interactive UI. You do not need WordPress to use the checklists.
Markdown control format
---id: apititle: API Security---# API Security## Authentication and Authorization### Broken object level authorization (BOLA/IDOR)**Severity:**`high`#### Description
Swap object IDs across users and roles; test horizontal and vertical access.
#### How to find
...
#### How to fix
...
#### Tools- Burp Suite
- Postman
#### References-[OWASP API Security Top 10](https://owasp.org/www-project-api-security/)
Required fields per control: title, severity, description, how_to_find, how_to_fix, tools.
Contribute
  1. Edit or add a file under categories/.
  2. If you add a new domain, register it in config/manifest.json.
  3. Keep severity values as critical, high, medium, low, or info.
  4. Prefer concrete testing steps over vague advice.
Related
LinkWhat it is
Interactive hubTrackable UI on SecurityCipher
awsome-websecurity-checklistExtra web testing notes
awsome-security-mindmapsSecurity mind maps
License / credit
Built and maintained by SecurityCipher. Contributions welcome.
About
securitycipher.com/security-checklist
Topics
active-directoryai-securityapi-securitybug-bountychecklistcloud-securitycybersecurityinfoseckubernetesmobile-securityowasppenetration-testingpentestingsecurity-checklistsecuritycipherweb-security
Resources
Readme
Activity
Stars
5 stars
Watchers
1 watching
Forks
1 fork
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
GitHub - securitycipher/security-checklists · GitHub
Skip to content
BranchesTags
Latest commit
History
45 Commits
Folders and files
NameName
Last commit message
Last commit date
categories
categories
config
config
docs
docs
site
site
README.md
README.md
manifest.json
manifest.json
Repository files navigation
Security Checklists
Open-source security testing checklists for real engagements - web, cloud, mobile, AI, API, Kubernetes, Active Directory, and more.
Use them interactively on the site, or read / fork them here as Markdown.
Open the interactive hub
· browse Markdown
SecurityCipher Security Checklists Hub - 18 categories and 1,760+ controls
Start here (for humans)
GoalWhere to go
Track progress in a browsersecuritycipher.com/security-checklists
Read / edit a checklist offlinecategories/*.md
See the category indexconfig/manifest.json
The interactive hub keeps Pass / Fail / N/A status and notes in your browser only. Export Markdown or CSV when you need a report artifact.
Web Application Security checklist detail with filters and progress
Expanded control with how-to-find and how-to-fix guidance
What's inside
  • 18 live categories
  • 1,760+ controls
  • Severity tags, tools, how-to-find / how-to-fix guidance, and references
  • Source format is Markdown so GitHub, editors, and LLMs can all read it cleanly
Categories
ChecklistFile
Web Application Securitycategories/web.md
Mobile Application Securitycategories/mobile.md
AWS Cloud Securitycategories/aws.md
Azure Cloud Securitycategories/azure.md
Google Cloud Platformcategories/gcp.md
LLM and AI Securitycategories/llm.md
MCP Server Securitycategories/mcp.md
AI Agent Securitycategories/agent-security.md
API Securitycategories/api.md
Kubernetes and Containerscategories/kubernetes.md
Cloud Security (Multi-Provider)categories/cloud.md
Active Directory Securitycategories/active-directory.md
Network Securitycategories/network.md
DevSecOps and CI/CDcategories/devsecops.md
OSINT and Reconnaissancecategories/osint.md
Infrastructure and Host Securitycategories/infrastructure.md
CI/CD Pipeline Securitycategories/cicd.md
Secure Code Reviewcategories/secure-code-review.md
Repo layout
categories/ # The checklists (Markdown - start here)
config/
manifest.json # Hub index (titles, colors, file paths)
manifest.json # Same index at repo root for raw GitHub clients
docs/
screenshots/ # README screenshots from the live hub
legacy/ # Older human-readable notes
site/
resource-pages.json # Companion content used by securitycipher.com

This repository is meant to stand alone. The website renders the same Markdown for the interactive UI. You do not need WordPress to use the checklists.
Markdown control format
---id: apititle: API Security---# API Security## Authentication and Authorization### Broken object level authorization (BOLA/IDOR)**Severity:**`high`#### Description
Swap object IDs across users and roles; test horizontal and vertical access.
#### How to find
...
#### How to fix
...
#### Tools- Burp Suite
- Postman
#### References-[OWASP API Security Top 10](https://owasp.org/www-project-api-security/)
Required fields per control: title, severity, description, how_to_find, how_to_fix, tools.
Contribute
  1. Edit or add a file under categories/.
  2. If you add a new domain, register it in config/manifest.json.
  3. Keep severity values as critical, high, medium, low, or info.
  4. Prefer concrete testing steps over vague advice.
Related
LinkWhat it is
Interactive hubTrackable UI on SecurityCipher
awsome-websecurity-checklistExtra web testing notes
awsome-security-mindmapsSecurity mind maps
License / credit
Built and maintained by SecurityCipher. Contributions welcome.
About
securitycipher.com/security-checklist
Topics
active-directoryai-securityapi-securitybug-bountychecklistcloud-securitycybersecurityinfoseckubernetesmobile-securityowasppenetration-testingpentestingsecurity-checklistsecuritycipherweb-security
Resources
Readme
Activity
Stars
5 stars
Watchers
1 watching
Forks
1 fork
Report repository
Releases
Packages
Contributors

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
GitHub - securitycipher/security-checklists · GitHub
Skip to content
BranchesTags
Latest commit
History
45 Commits
Folders and files
NameName
Last commit message
Last commit date
categories
categories
config
config
docs
docs
site
site
README.md
README.md
manifest.json
manifest.json
Repository files navigation
Security Checklists
Open-source security testing checklists for real engagements - web, cloud, mobile, AI, API, Kubernetes, Active Directory, and more.
Use them interactively on the site, or read / fork them here as Markdown.
Open the interactive hub
· browse Markdown
SecurityCipher Security Checklists Hub - 18 categories and 1,760+ controls
Start here (for humans)
GoalWhere to go
Track progress in a browsersecuritycipher.com/security-checklists
Read / edit a checklist offlinecategories/*.md
See the category indexconfig/manifest.json
The interactive hub keeps Pass / Fail / N/A status and notes in your browser only. Export Markdown or CSV when you need a report artifact.
Web Application Security checklist detail with filters and progress
Expanded control with how-to-find and how-to-fix guidance
What's inside
  • 18 live categories
  • 1,760+ controls
  • Severity tags, tools, how-to-find / how-to-fix guidance, and references
  • Source format is Markdown so GitHub, editors, and LLMs can all read it cleanly
Categories
ChecklistFile
Web Application Securitycategories/web.md
Mobile Application Securitycategories/mobile.md
AWS Cloud Securitycategories/aws.md
Azure Cloud Securitycategories/azure.md
Google Cloud Platformcategories/gcp.md
LLM and AI Securitycategories/llm.md
MCP Server Securitycategories/mcp.md
AI Agent Securitycategories/agent-security.md
API Securitycategories/api.md
Kubernetes and Containerscategories/kubernetes.md
Cloud Security (Multi-Provider)categories/cloud.md
Active Directory Securitycategories/active-directory.md
Network Securitycategories/network.md
DevSecOps and CI/CDcategories/devsecops.md
OSINT and Reconnaissancecategories/osint.md
Infrastructure and Host Securitycategories/infrastructure.md
CI/CD Pipeline Securitycategories/cicd.md
Secure Code Reviewcategories/secure-code-review.md
Repo layout
categories/ # The checklists (Markdown - start here)
config/
manifest.json # Hub index (titles, colors, file paths)
manifest.json # Same index at repo root for raw GitHub clients
docs/
screenshots/ # README screenshots from the live hub
legacy/ # Older human-readable notes
site/
resource-pages.json # Companion content used by securitycipher.com

This repository is meant to stand alone. The website renders the same Markdown for the interactive UI. You do not need WordPress to use the checklists.
Markdown control format
---id: apititle: API Security---# API Security## Authentication and Authorization### Broken object level authorization (BOLA/IDOR)**Severity:**`high`#### Description
Swap object IDs across users and roles; test horizontal and vertical access.
#### How to find
...
#### How to fix
...
#### Tools- Burp Suite
- Postman
#### References-[OWASP API Security Top 10](https://owasp.org/www-project-api-security/)
Required fields per control: title, severity, description, how_to_find, how_to_fix, tools.
Contribute
  1. Edit or add a file under categories/.
  2. If you add a new domain, register it in config/manifest.json.
  3. Keep severity values as critical, high, medium, low, or info.
  4. Prefer concrete testing steps over vague advice.
Related
LinkWhat it is
Interactive hubTrackable UI on SecurityCipher
awsome-websecurity-checklistExtra web testing notes
awsome-security-mindmapsSecurity mind maps
License / credit
Built and maintained by SecurityCipher. Contributions welcome.
About
securitycipher.com/security-checklist
Topics
active-directoryai-securityapi-securitybug-bountychecklistcloud-securitycybersecurityinfoseckubernetesmobile-securityowasppenetration-testingpentestingsecurity-checklistsecuritycipherweb-security
Resources
Readme
Activity
Stars
5 stars
Watchers
1 watching
Forks
1 fork
Report repository
Releases
Packages
Contributors