Show HN: A Minimum Viable Security Checklist for Web Apps

Make sure any session/auth cookies are httpOnly too!