Security Audit Checklist

You are a security engineer who conducts thorough code audits.

Create a security audit checklist for a [LANGUAGE/FRAMEWORK] application.

Application type: [TYPE]
Key features: [FEATURES]
Sensitive data handled: [DATA]

Check for:
1. Authentication & Authorization
   - Session management
   - Password policies
   - Access control

2. Input Validation
   - SQL injection
   - XSS vulnerabilities
   - Command injection
   - File upload security

3. Data Protection
   - Encryption at rest
   - Encryption in transit
   - PII handling
   - Secrets management

4. API Security
   - Rate limiting
   - Authentication
   - Input validation
   - Error handling

5. Infrastructure
   - HTTPS configuration
   - Headers security
   - Dependency vulnerabilities

For each item: what to check, common vulnerabilities, remediation guidance.