This seems like a very good basic guideline. I have actually been meaning to do some additional security review of various personal projects after reading the Instagram bounty article. This will be very helpful, thanks!