Web3 Product Security Checklist

0 of 35 completed (0%)

Pre-Development Security

Security considerations before building.

Threat model documented

critical

Document who might attack, how, and what is at risk. Drives security decisions.

Security budget allocated

critical

Audits, bug bounties, and security tools cost money. Budget for them.

Audit timeline in roadmap

critical

Audits take weeks and have waitlists. Schedule early.

Compliance requirements identified

critical

GDPR, SOC2, regulatory requirements affect design. Know them early.

Data minimization planned

important

Collect only data you need. Less data means less risk.

Smart Contract Requirements

Requirements for on-chain components.

Upgradeability decision made

critical

Decide if contracts can be upgraded. Both choices have tradeoffs.

Admin key management planned

critical

Who holds admin keys? Multisig? Timelock? Document the plan.

Emergency procedures defined

critical

What happens if we find a bug? Pause mechanism? Response plan?

Audit scope defined

critical

Which contracts need audit? What severity findings are acceptable?

Bug bounty program planned

critical

Post-launch security coverage. Budget, scope, and platform decided.

User Security

Protecting users.

Wallet connection security reviewed

critical

Users understand what they are signing. Clear transaction descriptions.

Phishing protection in place

critical

Official links documented. Verification guidance for users.

Token approval limits considered

critical

Request only needed approvals. Avoid unlimited approvals when possible.

User fund recovery planned

important

Can users recover if they lose access? What are the limitations?

Support for hacked users

important

What do we tell users who get phished? Support documentation ready.

Launch Readiness

Security items before launch.

Audit completed and issues resolved

critical

All critical and high findings fixed. Medium findings tracked.

Bug bounty launched before or at mainnet

critical

Security researchers can report issues. Rewards ready.

Monitoring and alerting configured

critical

Anomaly detection. Alert when unusual activity occurs.

Incident response plan documented

critical

Who does what if something goes wrong. Contact list ready.

Communication templates prepared

important

Pre-written templates for security incidents. Faster response.

Insurance or reserve fund

important

Consider coverage or reserve fund for security events.

Vendor and Third-Party Security

External dependencies.

Third-party contract risks assessed

critical

External protocols we depend on. What if they get hacked?

Oracle security reviewed

critical

If using price oracles, understand manipulation risks.

Bridge security evaluated

critical

Cross-chain bridges are high-risk. Know the security model.

RPC provider redundancy

important

Multiple RPC providers. Fallback if one is down or compromised.

Ongoing Security

Post-launch security management.

Regular security reviews scheduled

critical

Security is not one-time. Schedule regular reviews.

Dependency updates tracked

important

Keep track of security updates in dependencies.

Bug bounty submissions reviewed

critical

Process for triaging and responding to reports.

Security metrics tracked

important

Track security-related metrics. Time to fix, report quality.

Third-Party Risk Management

Managing risks from external dependencies.

Oracle provider evaluated

critical

Understand oracle trust assumptions and failure modes.

Bridge risks documented

critical

Know risks of any bridges your protocol uses or integrates with.

API dependencies listed

important

Document all external APIs. Plan for their failure.

Vendor security assessed

important

Evaluate security practices of key vendors and partners.

RPC provider redundancy

important

Multiple RPC providers to avoid single point of failure.

IPFS pinning strategy

important

Ensure critical metadata is pinned and will persist.

Key Recommendations

Security checklists should be part of the product spec, not an afterthought.

Involve the security team in design reviews, not just code reviews.

Document known risks and accepted trade-offs explicitly.

Looking for Web3 Opportunities?

Explore curated, high-impact roles across top blockchain protocols and Web3 startups.

Web3 Product Security Checklist

Pre-Development Security

Smart Contract Requirements

User Security

Launch Readiness

Vendor and Third-Party Security

Ongoing Security

Third-Party Risk Management

Key Recommendations

More Guides for Web3 Product Managers

Looking for Web3 Opportunities?