Backend Security
The checklist every service owes: injection, SSRF, dependency risk, secrets discipline and defence in depth, from the implementer's side rather than the attacker's.
The controls every service owes no matter what it does, and the layer each one has to live in.
Parameterized queries solve injection completely — and do nothing whatsoever for authorization.
The shell is a parser you did not intend to invoke. Pass an argument array, or do not spawn a process at all.
A fetch your server makes on a caller's behalf runs from inside your network with your identity. Blocklists lose; egress control holds.
Most of your running code was written by strangers. The controls are reproducible installs, a known time-to-patch, and a build that does not hand out credentials.
Logging a request object, an auth header or a webhook payload copies a credential into every system your logs reach.
Design as if each control has already failed, and prefer controls that work when someone forgets.