Draft a code review checklist for secure REST API development when exposing internal financial data systems via GraphQL endpoints

System Architecture Documentation *

Financial Data Classification Level * Select data classification level Public Financial Reports (10-K, 10-Q, Annual Reports) Customer Financial Data (Account Balances, Transaction History) Investment Portfolio Data (Holdings, Performance Metrics, NAV) Trading Data (Orders, Executions, Market Positions) Credit Risk Data (Credit Scores, Ratings, Default Probabilities) Regulatory Reporting Data (Basel III, CCAR, Dodd-Frank) Personal Financial Information (PII, Bank Account Details) Proprietary Trading Algorithms and Strategies Real-time Market Data and Pricing

Regulatory Compliance Frameworks * Select compliance frameworks SOX (Sarbanes-Oxley Act) Section 404 GDPR (General Data Protection Regulation) PCI DSS (Payment Card Industry Data Security Standard) GLBA (Gramm-Leach-Bliley Act) FFIEC Guidelines for API Security SEC Regulation SCI FATCA (Foreign Account Tax Compliance Act) Basel III Risk Data Requirements MiFID II (Markets in Financial Instruments Directive) CCPA (California Consumer Privacy Act) SOX Compliance for Financial Reporting APIs Internal Risk Management Policy

API Security Requirements *

Stakeholder Risk Tolerance * Choose risk tolerance level Conservative - Zero tolerance for data exposure incidents, maximum security layers Moderate - Accept controlled risk for business agility with strict monitoring Balanced - Security measures proportional to data classification and business value Progressive - Optimize for developer experience while maintaining baseline security Experimental - Allow non-sensitive financial data APIs for innovation sandbox

GraphQL Query Complexity Limits * Select complexity management approach Strict: Max depth 3 levels, complexity score 100, field limitations per query Controlled: Max depth 5 levels, complexity score 500, rate limiting per user Standard: Max depth 7 levels, complexity score 1000, progressive rate limits Flexible: Max depth 10 levels, complexity score 2000, dynamic scaling limits Custom: Require manual specification of depth, complexity, and rate limits

Data Masking and Tokenization Rules *

Monitoring and Alerting Thresholds * Select monitoring approach Real-time: Sub-second alerting for any unauthorized access attempt or data anomaly Near real-time: 1-minute alerting for security events, 5-minute for performance issues Standard: 5-minute alerting for security events, 15-minute for performance degradation Batch: Hourly summary reports with immediate alerts only for critical incidents Audit-only: Daily security reports with reactive incident response capabilities

Review Cycle Frequency * Choose review frequency Continuous: Update checklist immediately upon new threat intelligence Weekly: Review and update checklist every Monday for emerging security issues Monthly: Scheduled review at month-end for regulatory and security updates Quarterly: Comprehensive review aligned with audit and compliance cycles Semi-annually: Major updates during security architecture planning cycles Event-driven: Update only when new regulations or security incidents occur

Team Security Expertise Level * Choose team expertise level Expert Team: Senior security engineers with financial services background Advanced: Experienced developers with security certifications (CISSP, CISA) Intermediate: Standard development team with basic security training Developing: Junior developers needing detailed guidance on security practices Mixed: Team with varying levels of security knowledge and experience

Legacy System Integration Scope *