Available now
Security Audit Playbook for Web Apps
A repeatable 10-phase framework with real anonymized audit examples.
€39
Questions or support: info@shippedstack.com
A repeatable 10-phase framework with real anonymized audit examples.
Questions or support: info@shippedstack.com
Most security playbooks you find online are 50 pages of threat-modeling theory with no concrete output. You finish reading with no idea what a real audit report even looks like when the framework hits your server.
This is the opposite. A repeatable 10-phase framework, a 0–100 scoring system that produces comparable audits over time, 15 vulnerability categories with fix patterns — and, the differentiator, two real production audit reports reproduced in full, anonymized.
Every pattern here came from shipping events. The 10-phase framework ran more than six times on real production servers. The scoring system has tracked a real SaaS from grade F (score 23) to grade B (score 75) across six weeks of focused remediation. The deep audit reviewed 5 commits of production code with four reviewer roles in parallel and surfaced 9 confirmed findings.
Secrets, auth, network, containers, database, hardening, TLS, codebase, monitoring, delta. Each with a checklist, severity ratings, and a shell-based approach. One page of framework drives every audit.
Weighted by severity. Same weights every audit, so the trend is honest. Grades A/B/C/D/F with context for what each grade means for a small-team SaaS.
The failure modes seen five or more times each, with the shape of the problem, the fix, and common objections. Rate limiter fails open. Container runs as root. Payment webhook not idempotent. The rest.
An actual audit report, 49 findings, verbatim structure and numbers, names and IPs anonymized. Executive summary, scope, methodology, findings by severity, remediation plan, verification after fixes shipped. Grade F (23) to Grade B (75) trajectory.
A second anonymized audit — code-level, not infrastructure-level. Four reviewer roles (Silent Failure Hunter, Type/Logic Analyzer, Security Scanner, Quality Reviewer) producing 18 raw findings → 9 confirmed. Including the dismissed findings and why.
Baseline JSON file, trend states, the chart every team should keep, anti-patterns like score hacking.
Impact × Effort grid, the order that usually wins, when to ignore findings, when to trigger an emergency re-audit.
Top 10 (2021) mapped onto the 10-phase framework in both directions.
No. Pentests probe the app from the attacker's perspective with tools like Burp Suite, nmap, sqlmap. This playbook probes your infrastructure and code from the operator's perspective, via shell commands and code review. Both have value; they are different tools. Many teams run both — an annual external pentest plus monthly internal audits from this framework.
No code snippets to copy-paste. The playbook is a methodology playbook, not a tooling tutorial. Audit approaches use standard CLI tools (find, grep, ss, ps, container runtime CLI) that you already know. The two real audit reports show you what findings look like in practice.
The methodology is stack-agnostic. Audit approaches use POSIX shell commands and are illustrated against Linux hosts running containers — the common SaaS deployment shape. WSL users can run every command shown. Windows-only production environments are not covered.
No. Those compliance frameworks have their own specific control checklists. This playbook will help you pass them by keeping your posture tight between audits — it is not a substitute for the compliance checklist itself.
Real. Names, IP addresses, exact file paths, and version numbers have been anonymized. The structure, findings, severities, scores, remediation timeline, and verification results are verbatim from real audits on real production systems.
Monthly for a growing SaaS with paying users. Quarterly if the product is stable and the team is small. Weekly quick-hygiene (phases 1, 2, 4) for anything where the blast radius of a compromise is large. The book has a full frequency table with reasoning.
The framework generalizes. The 10 phases are named after what they cover, not after a specific tool — "Database Security" works whether you run PostgreSQL, MySQL, or managed cloud DB. Adapt the checks to your stack; keep the phases.
Security Audit Playbook for Web Apps — €39 one-time, lifetime v1.x updates, 30-day refund.