Free field guide · 32 checks

The Pre-PMF SaaS Audit Checklist

32 points · OWASP Top 10 + 152-ФЗ baseline + production stability

A field-tested checklist for technical founders and CTOs. The same questions I open every audit engagement with. Run through this in 1–2 hours; expect to find at least 4–5 items where the answer is “I don’t know” or “we’ll fix that later” — those are where engagements usually start.

— Egor Sazanov, Addicted Lab · Updated August 2026

How to use this

Print it. Fill it with a pen. Or open it in your favourite checklist app. Each item has three answers:

• ✓ — Verified working in production. You can show us the line of code or the dashboard.
• ? — Probably working. Nobody on the team has checked recently.
• ✗ — Known broken, or “we’ll fix it after launch.”

Tally your ✗ and ? counts at the end.

Part 1 — Auth & Identity (8 items)

1. Password hashing. Are all user passwords stored as bcrypt/argon2 hashes (cost ≥10), never plaintext, never MD5/SHA1?
2. JWT signing. Is your JWT secret ≥256 bits, rotated on a schedule (or rotatable on demand), and stored in env vars (not in code)?
3. JWT session mutation. Can a logged-in user mutate their own session payload through a public endpoint to change their role, tenant, or company? (/api/auth/session POST with a modified body — try it.)
4. Multi-tenant isolation. Does every database query that touches user-owned resources include a companyId / tenantId filter? Grep prisma.findFirst / findUnique / findMany and check.
5. API key scope. Can a leaked API key from Company A access Company B’s resources? Check /api/v1/contractors/[id] or equivalent.
6. Password reset enumeration. Does your forgot-password endpoint return a different response for “email exists” vs “email doesn’t exist”? It shouldn’t.
7. SuperAdmin script. Is there a scripts/create-superadmin.ts or equivalent that hardcodes default credentials? Has it run in production?
8. 2FA / MFA. Is 2FA available for admin accounts? Required?

Part 2 — Endpoints & Webhooks (6 items)

9. Webhook signature verification. If you receive webhooks (Stripe, Okidoki, payment providers), does your code verify HMAC signatures? Does the code path fail closed if the secret is missing, or fail open?
10. Rate limiting. Is there a rate limit on /api/auth/login, /api/auth/register, /api/contractors/invite, password reset endpoints, file upload? (Hint: most “we’ll add it later” answers go here.)
11. OnlyOffice / file-edit callbacks. If you use OnlyOffice or similar collaborative editors, is the callback URL authenticated? (Default config = public.)
12. Public file endpoints. Does /api/files/[id] or /onlyoffice/file validate that the requester owns the file?
13. CORS. Does your API allow Access-Control-Allow-Origin: *? It shouldn’t, except for explicitly public endpoints.
14. CSRF tokens. Are state-changing endpoints (POST/PUT/DELETE) protected against CSRF, especially for cookie-based auth?

Part 3 — Data & PII (6 items)

15. Passport data. Are passport scans / serial numbers stored encrypted at rest (AES-256-GCM with a rotated key)?
16. СНИЛС / ИНН. Same as #15 — encrypted, not plaintext.
17. Logging PII. Do production logs contain full request bodies including PII? (Hint: search logs for known passport patterns, emails, phone numbers.)
18. OCR vendors. If you send documents to Yandex Cloud OCR, OpenAI Vision, or any cloud AI for processing — do you have a signed DPA (Data Processing Agreement) with that vendor under 152-ФЗ?
19. Consent logging. Do you have a consent_logs table that records when each user agreed to data processing, with timestamp + IP + version of the policy?
20. Data minimization. Are you collecting fields you don’t actually use? Each unused field is a future incident waiting.

Part 4 — Infrastructure & Stability (6 items)

21. PostgreSQL idle timeout. Does your DB host (Timeweb, AWS RDS, etc.) terminate idle connections? Is your Prisma / ORM pool configured for keepalive? (Symptom: random FATAL terminating connection due to idle-session timeout in logs.)
22. Connection pool sizing. Is your DB pool size ≥ peak concurrent requests? Or do you get random ECONNREFUSED under load?
23. Backup snapshots. Are daily DB backups running? When was the last restoration test?
24. TLS. Does your DB connection string include sslmode=require? Is S3/storage encrypted at rest?
25. Error visibility. Do you have Sentry / Bugsnag / similar capturing production errors? If not — your customer support is your error log.
26. Deployment rollback. Can you roll back a bad deploy in <5 minutes? Have you tested it this quarter?

Part 5 — 152-ФЗ Compliance (6 items)

27. Privacy policy. Is it published, public-URL, and current (last updated <12 months ago)?
28. Operator registration. Is your company registered in the Роскомнадзор реестр операторов ПД?
29. Data localization. If you process РФ-citizen data, is the primary database hosted in РФ?
30. DPA inventory. Do you have signed DPAs with every third party that processes user data on your behalf? (Cloud OCR, email senders, analytics tools, payment processors.)
31. Ответственный по ст. 22.1. Is there a named person responsible for PII processing in the company?
32. Incident response plan. If you have a breach, do you know within how many hours you have to notify Роскомнадзор? (Hint: 24 hours for the fact, 72 hours for details.)

Scoring

• 0–3 ✗+? items: You’re ahead of most pre-PMF SaaS. Re-run this quarterly.
• 4–8 ✗+? items: Normal. Most paying customers won’t notice — but the first regulator inspection or security incident will.
• 9+ ✗+? items: You have meaningful exposure. The good news: most of these are fixable in 1–4 weeks of focused work.

If your count is in the 9+ band, that’s typically what an Express Audit (₽180k / 2 weeks) targets — find every item, write the fix plan, hand it to your team.

Next steps

• Self-fix. Most items have public OWASP / ФСТЭК documentation.
• Read deeper. PortSwigger Web Security Academy is free and excellent.
• Get help. my@addicted.design — tell us what you found.

Open under CC-BY 4.0. Share. Adapt. Run on your team. Keep the attribution.

Need an evidence-backed review? See the Addicted SaaS audit.