Ask HN: Comprehensive security checklist for developers

In the light of the recent Amazon and Apple incident, and considering that HN is full of insightful comments regarding security buried in many discussions:

What would be a comprehensive security checklist for developers?

i.e. everything from OWASP, Schneier, best of the security web etc.

For example, just to get started:

1. Use bcrypt.

2. Use different non-guessable private email addresses and passwords for critical services.

3. Self-host critical email addresses.

4. Two-factor authentication.

5. Disable iCloud Find My Mac or disable iCloud completely.

6. Use FileVault2 or full disk encryption.

7. Set your system to log out after inactivity.

8. Set your screensaver with password to show after 5 minutes.

9. Use a passcode on your iPad.

10. Master server should not have access to backup server.

We tend to focus on securing the app we develop, without thinking too much about securing the suppliers we use, or reducing surface area, or considering orthogonal vectors.

There are many great checklists covering certain aspects of security, but it would be great to have all of this in one place.