Security audits for solo devs: a 45-minute checklist

You don't need a security team to run a basic security audit. You need 45 minutes, three tools, and the discipline to actually do it before every client delivery.

Minute 0-10: Secret scanning with gitleaks

Run gitleaks on your repository. It scans your git history for API keys, passwords, tokens, and other secrets that shouldn't be in version control. If it finds something, you have a problem. If it doesn't, you can move on with confidence.

Set up gitleaks as a pre-commit hook so you never have to worry about this again. One command, permanent protection.

Minute 10-25: Dependency auditing with pip-audit

Run pip-audit on your requirements. It checks every dependency against the Python Packaging Advisory Database. If any of your dependencies have known vulnerabilities, you'll know about it.

The fix is usually simple: upgrade to the patched version. The hard part is finding out before your client does.

Minute 25-40: Static analysis with bandit

Run bandit on your codebase. It finds common security issues: SQL injection, hard-coded passwords, insecure random number generation, and a dozen other patterns that attackers love.

Bandit produces false positives. That's fine. Review the medium and high severity findings. Ignore the low severity ones unless they're in security-critical code.

Minute 40-45: The final check

Review your environment variables. Make sure no secrets are hardcoded in configuration files. Check that your .gitignore excludes sensitive files. Verify that your Docker image doesn't include development dependencies.

45 minutes. Three tools. A baseline security posture that protects you and your clients. Do it before every delivery. Make it a habit, not an afterthought.