체크리스트

배포 전, API 디버깅, 보안 리뷰에서 하나씩 확인하세요

🚀 Before you ship (5)

Five minutes before deploy; catches most silly incidents

  • Certificate valid with enough days left

    Not just "no browser warning" — the cert may expire in three days. Check days remaining first.

    도구 열기 →

  • Security headers present

    At minimum HSTS, CSP and X-Content-Type-Options; missing ones show up in pentest reports.

    도구 열기 →

  • Cron expressions fire when you expect

    "Daily at 3" and "every 3 hours" are different expressions; check the next five run times.

    도구 열기 →

  • Static assets are hashed so long caching is safe

    One-year caching on non-hashed filenames means users never get the new version.

  • DNS points correctly; apex and www both resolve

    A missing apex A record is the classic "only half the users can open it".

    도구 열기 →

🔌 When an API call fails (6)

Work through these in order — much faster than staring at the code

  • Is the JWT expired? Check exp.

    Decode the payload; exp is a second-level timestamp — compare with now.

    도구 열기 →

  • Timestamp unit wrong (s vs ms)?

    Backend returns seconds, frontend treats as ms — dates land in 1970 or the far future.

    도구 열기 →

  • Base64 payload decodes cleanly

    Mixing URL-safe (-_) with standard (+/) variants fails silently on decode.

    도구 열기 →

  • Which path holds the field you want

    Probe the path with JSON Path first, then write it into code.

    도구 열기 →

  • How do the two environments differ

    Paste both responses into the structural diff to see exactly which field differs.

    도구 열기 →

  • Are special characters in params escaped

    A raw & = # or space in a query truncates it into a different parameter.

    도구 열기 →

🛡️ Certificate and header self-check (5)

Most "low severity" scanner findings live here

  • HTTPS enforced for apex and subdomains

    HSTS needs includeSubDomains, or subdomains can still be downgraded.

    도구 열기 →

  • CORS is not a blanket wildcard

    Credentialed endpoints reject "*" anyway; for public ones, decide whether anyone should call it.

    도구 열기 →

  • Every URL-accepting endpoint filters private ranges

    Syntax checks are not enough; validate resolved IPs too, or DNS can point at 127.0.0.1.

    도구 열기 →

  • Full certificate chain, not just the leaf

    Missing intermediates often work on desktop (cached) but fail on mobile.

    도구 열기 →

  • Private ranges do not collide with public ones

    Using non-private ranges internally breaks broadly once VPN connects.

    도구 열기 →