Security Checklists

Open-source security testing checklists for real engagements - web, cloud, mobile, AI, API, Kubernetes, Active Directory, and more.

Use them interactively on the site, or read / fork them here as Markdown.

Open the interactive hub  ·  browse Markdown

Start here (for humans)

Goal	Where to go
Track progress in a browser	securitycipher.com/security-checklists
Read / edit a checklist offline	categories/*.md
See the category index	config/manifest.json

The interactive hub keeps Pass / Fail / N/A status and notes in your browser only. Export Markdown or CSV when you need a report artifact.

What's inside

• 18 live categories
• 1,760+ controls
• Severity tags, tools, how-to-find / how-to-fix guidance, and references
• Source format is Markdown so GitHub, editors, and LLMs can all read it cleanly

Categories

Checklist	File
Web Application Security	categories/web.md
Mobile Application Security	categories/mobile.md
AWS Cloud Security	categories/aws.md
Azure Cloud Security	categories/azure.md
Google Cloud Platform	categories/gcp.md
LLM and AI Security	categories/llm.md
MCP Server Security	categories/mcp.md
AI Agent Security	categories/agent-security.md
API Security	categories/api.md
Kubernetes and Containers	categories/kubernetes.md
Cloud Security (Multi-Provider)	categories/cloud.md
Active Directory Security	categories/active-directory.md
Network Security	categories/network.md
DevSecOps and CI/CD	categories/devsecops.md
OSINT and Reconnaissance	categories/osint.md
Infrastructure and Host Security	categories/infrastructure.md
CI/CD Pipeline Security	categories/cicd.md
Secure Code Review	categories/secure-code-review.md

Repo layout

categories/                 # The checklists (Markdown - start here)
config/
  manifest.json             # Hub index (titles, colors, file paths)
manifest.json               # Same index at repo root for raw GitHub clients
docs/
  screenshots/              # README screenshots from the live hub
  legacy/                   # Older human-readable notes
site/
  resource-pages.json       # Companion content used by securitycipher.com

This repository is meant to stand alone. The website renders the same Markdown for the interactive UI. You do not need WordPress to use the checklists.

Markdown control format

---
id: api
title: API Security
---

# API Security

## Authentication and Authorization

### Broken object level authorization (BOLA/IDOR)

**Severity:** `high`

#### Description
Swap object IDs across users and roles; test horizontal and vertical access.

#### How to find
...

#### How to fix
...

#### Tools
- Burp Suite
- Postman

#### References
- [OWASP API Security Top 10](https://owasp.org/www-project-api-security/)

Required fields per control: title, severity, description, how_to_find, how_to_fix, tools.

Contribute

1. Edit or add a file under categories/.
2. If you add a new domain, register it in config/manifest.json.
3. Keep severity values as critical, high, medium, low, or info.
4. Prefer concrete testing steps over vague advice.

Related

Link	What it is
Interactive hub	Trackable UI on SecurityCipher
awsome-websecurity-checklist	Extra web testing notes
awsome-security-mindmaps	Security mind maps

License / credit

Built and maintained by SecurityCipher. Contributions welcome.