Severity rating of checks

[vannut]

For the security checklist I've thought of some nice checks. But some of them are have a greater impact on security then others. Behold: check-severity. A number to define the severity of the check.

The severity is an integer ranging from 1-5.

These are the checks currently implemented and ther severity-rating

• 5 AppInDebugMode,
• 5 IsAppSecretKeySet,
• 5 NotUsingDefaultAdminCredentials,
• 1 UsingPublicFolder,
• 3 ComposerWithoutDevDep,
• 4 IsTheInstallerDeleted,
• 4 IsCSRFProtectionEnabled,
• 2 AreWeUseingDotEnv
• 2 DoWeEncryptSessionData,
• 3 DefaultCookieName,
• 2 HttpsOnlyCookies

I wonder what you guys @LukeTowers, @CptMeatball think about this severity-rating.

[LukeTowers]

I would say the public folder prevents a large class of attacks against vulnerable dependencies so it should have more of a weight behind it.

[CptMeatball]

I think it's a good place to start. As the plugin develops we see things that are missing or if we need a different rating system.

HasSslEnabled might also be a check?