A checklist covers only what you remembered to write down: describe the app first.

Before you tick any box, spend a few minutes listing the data, roles, inputs, outside services and hosting. Anything missing from that page, such as an export job or a third-party integration, quietly drops out of the review. Starting from a vulnerability list, or from the latest news, tests the world in general rather than your application.

Read it once, then a question tests whether the trick stuck.