A checklist of basic (and less basic) things to do to have a secured webapp. If you cannot check all the boxes, then your app is probably not secure enough, and shouldn't be advertised as such.