Red flags
Hidden credentials, broad deletes, silent catches, unbounded loops, and “works on my machine” test evidence.
Review scripts like an operator before they touch production: confirm inputs, permissions, idempotency, logging, and rollback instead of trusting a clean test run.
Use this during peer review, change approval, or your own final pass before packaging a script for endpoint deployment.
20
Checks
5
Stages
Low
Risk debt
Fast
Review
Check every item. If an answer is “not yet,” record the fix or explicitly accept the risk before deployment.
Hidden credentials, broad deletes, silent catches, unbounded loops, and “works on my machine” test evidence.
Record reviewer, commit or version, test device, date, open risks, and approval outcome.
This checklist is a review aid, not a security certification. Apply your organization’s change and secret-management controls.