Security Patterns

Quick Guide: Managing secrets? Use .env.local (gitignored), CI secrets, rotate on compromise or team changes. Dependency security? Enable automated scanning (Dependabot), patch critical vulns within 24hrs. XSS prevention? Modern frameworks auto-escape output by default - never bypass with raw HTML injection unless sanitized with DOMPurify. Set CSP headers. CODEOWNERS? Require security team review for auth/, .env.example, workflows.

Detailed Resources:

• For code examples, see examples/core.md (essential patterns)
• For decision frameworks and anti-patterns, see reference.md

Additional Examples:

• examples/xss-prevention.md - XSS protection, DOMPurify, CSP headers
• examples/dependency-security.md - Dependabot, CI security checks
• examples/access-control.md - CODEOWNERS, rate limiting, branch protection

<critical_requirements>