Some items where alright, but I agree with what tptacek wrote elsewhere in this thread (https://news.ycombinator.com/item?id=29102385).

Another list that I think is better for most startups: https://www.goldfiglabs.com/guide/saas-cto-security-checklis...