I've been using my D7 installation as a single-user blog, and operated assuming that would always be the case. In the process, I may have been sloppy with permissions in various places, such as viewing, authoring, input formats, etc.---I'm no longer sure.
Now, however, I am going to open my site to subscribers (for a mailchimp mailing list), and possibly allow another content author.
Before I undertake these, what should I go over to make sure I'm safe, and ensure my site stays secure and is well permissioned? Can someone help me construct a security checklist for all items I need to verify to move from single-user to multi-user?