Security Baseline

Most AI-built apps are not compromised because the agent chose a weak cipher. They are compromised because nobody decided what level of protection the app needed, so basic controls were skipped while advanced ones were discussed.

Core principle: match the security floor to the app's actual risk, then verify it with evidence.

Three rules follow from that:

1. Level 1 is mandatory for anything internet-facing and production-bound.
2. Higher levels are additive, not automatic. Add them when the app's data, exposure, or blast radius justifies the cost.
3. A control is not done because code exists. It is done when a test, a configuration, or a code path proves it works.

When to Use