Although the promise of the latest generation of "thinking" models is that they're supposed to do that themselves - in the internal chat thread in their "though

Although the promise of the latest generation of "thinking" models is that they're supposed to do that themselves - in the internal chat thread in their "thought" process they're supposed to go "what does secure mean for a web app", list those items (which it can already easily do if you prompt it separately) and then go through that list