Strategy — Security First

When to use

• The task involves accepting or processing data from outside the program — user requests, uploaded files, external APIs, or queue messages.
• The task touches secrets or sensitive values — API keys, passwords, tokens, or personal data — that must not leak into logs or output.
• The user asks to harden code, review it for security, or choose safe defaults so that mistakes fail closed rather than open.

When NOT to use