Security

Rule

Treat each action, route, query, and external request as a trust boundary. Validate inputs, check the caller's authority for every row, and fail closed when access cannot be established.

Validate input and queries

• Define action inputs with a Zod schema; validate data from forms, URLs, providers, and files before using it.
• Build database queries with Drizzle. For raw SQL, bind values as parameters; never concatenate user input into SQL text.
• Keep large uploads and file contents in file storage. Store only their returned ids or URLs in SQL.

Authorize rows and actions