Ask HN: Pointers to resources for an internal security review

We would like to do a comprehensive security review of our product and code pre-launch as we interact with user databases. While we are well aware of SOC 2 (and might eventually get certification), are interested to know if the community knows of good checklists or other materials they can share.

Searching on Google is pretty useless as the SOC 2 companies flood the results with clickbait and SEO garbage.