Is there some checklist some place that can be used to beat people over the head with the very basics of security for a user-facing site?

Sort of, "If your developers are doing this today, they are grossly incompetent and you are putting your business and customers at risk."