Web3 Product Security Checklist | Hashtag Web3

0 of 35 complete

Pre-Development Security

Security considerations before building.

Threat model documentedcritical

Document who might attack, how, and what is at risk. Drives security decisions.

Security budget allocatedcritical

Audits, bug bounties, and security tools cost money. Budget for them.

Audit timeline in roadmapcritical

Audits take weeks and have waitlists. Schedule early.

Compliance requirements identifiedcritical

GDPR, SOC2, regulatory requirements affect design. Know them early.

Data minimization plannedimportant

Collect only data you need. Less data means less risk.

Smart Contract Requirements

Requirements for on-chain components.

Upgradeability decision madecritical

Decide if contracts can be upgraded. Both choices have tradeoffs.

Admin key management plannedcritical

Who holds admin keys? Multisig? Timelock? Document the plan.

Emergency procedures definedcritical

What happens if we find a bug? Pause mechanism? Response plan?

Audit scope definedcritical

Which contracts need audit? What severity findings are acceptable?

Bug bounty program plannedcritical

Post-launch security coverage. Budget, scope, and platform decided.

User Security

Protecting users.

Wallet connection security reviewedcritical

Users understand what they are signing. Clear transaction descriptions.

Phishing protection in placecritical

Official links documented. Verification guidance for users.

Token approval limits consideredcritical

Request only needed approvals. Avoid unlimited approvals when possible.

User fund recovery plannedimportant

Can users recover if they lose access? What are the limitations?

Support for hacked usersimportant

What do we tell users who get phished? Support documentation ready.

Launch Readiness

Security items before launch.

Audit completed and issues resolvedcritical

All critical and high findings fixed. Medium findings tracked.

Bug bounty launched before or at mainnetcritical

Security researchers can report issues. Rewards ready.

Monitoring and alerting configuredcritical

Anomaly detection. Alert when unusual activity occurs.

Incident response plan documentedcritical

Who does what if something goes wrong. Contact list ready.

Communication templates preparedimportant

Pre-written templates for security incidents. Faster response.

Insurance or reserve fundimportant

Consider coverage or reserve fund for security events.

Vendor and Third-Party Security

External dependencies.

Third-party contract risks assessedcritical

External protocols we depend on. What if they get hacked?

Oracle security reviewedcritical

If using price oracles, understand manipulation risks.

Bridge security evaluatedcritical

Cross-chain bridges are high-risk. Know the security model.

RPC provider redundancyimportant

Multiple RPC providers. Fallback if one is down or compromised.

Ongoing Security

Post-launch security management.

Regular security reviews scheduledcritical

Security is not one-time. Schedule regular reviews.

Dependency updates trackedimportant

Keep track of security updates in dependencies.

Bug bounty submissions reviewedcritical

Process for triaging and responding to reports.

Security metrics trackedimportant

Track security-related metrics. Time to fix, report quality.

Third-Party Risk Management

Managing risks from external dependencies.

Oracle provider evaluatedcritical

Understand oracle trust assumptions and failure modes.

Bridge risks documentedcritical

Know risks of any bridges your protocol uses or integrates with.

API dependencies listedimportant

Document all external APIs. Plan for their failure.

Vendor security assessedimportant

Evaluate security practices of key vendors and partners.

RPC provider redundancyimportant

Multiple RPC providers to avoid single point of failure.

IPFS pinning strategyimportant

Ensure critical metadata is pinned and will persist.