Few other checkpoints can be used to develop a benchmark for the application security.
You need to check against cross sites request forgery which is actually a common type of attack that
tricks web browsers into executing unwanted actions in an application in which a user is legitimately
logged into.
Another thing that you need to check against is remote file inclusion where you need to restrict the
upload of malicious extension of files such as x hp javascript and even some l files.
As we've seen earlier the perpetrators goal is to exploit the referencing functions in an application
to upload their malware which can be a backdoor that will totally compromise the server and steal your
information.
Make sure as well to check against click joking which is a malicious practice of manipulating your website
user's activity by concealing hyperlinks under legitimate clickable content thereby the attacker will
force the user to perform actions that they are unaware of.