Red flags
Hidden credentials, broad deletes, silent catches, unbounded loops, and “works on my machine” test evidence.
Review scripts like an operator before they touch production: confirm inputs, permissions, idempotency, logging, and rollback instead of trusting a clean test run.
Check every item. If an answer is “not yet,” record the fix or explicitly accept the risk before deployment.
Hidden credentials, broad deletes, silent catches, unbounded loops, and “works on my machine” test evidence.
Record reviewer, commit or version, test device, date, open risks, and approval outcome.
This checklist is a review aid, not a security certification. Apply your organization’s change and secret-management controls.