padosoft-security-baselinelisted

# Security baseline Most applications are not insecure because somebody wrote a bad line. They are insecure because a whole **domain** was never considered, and nothing about the code says so. This is the list of domains, what makes each one real rather than declared, and the order to take them in. **The rule: a control you cannot prove is a control you do not have — and a control that only new code respects is half a control.** --- ## 1. Three things that invalidate defences you already paid for Before any list, check these. Each one silently cancels controls that appear to be in place. 1. **The origin must be reachable only through the edge.** If the application answers requests that did not come through the CDN, WAF or proxy, then every edge rule — bot management, rate limits, IP reputation, the trusted client-address header — is an opt-in the attacker declines. Every control that trusts a header set by the edge is only as true as this. 2. **After any credential or key exposure, rotate and then verify what the rotation broke.** The application signing key usually underwrites sessions, cookies, signed URLs and stored tokens at once; rotating it is correct and it invalidates all four. Rotating without checking them is how a fix becomes an outage; *not* rotating is how an incident stays open. 3. **A language with no static analysis in the pipeline has no automated floor.** If the main language of the codebase is not covered by a scanner, every findi