I'm often asked to do a security review of extensions for some clients. This can be daunting but one of the easiest safety checks to do is ensure the define('_JEXEC') or die line is in every PHP file. I've written this tool to help automate that process.

www.theartofjoomla.com/extensions/jhttp-scan.html

I'd love it if some site implementers can run it over their standard "stacks" to see what they come up with.

Please note, this is not an extension, it's a command line utility.

And just for reference, the next steps I do is a sweep on global variables, then I check every database setQuery call to ensure variables are being correctly sanitised.