Security

Secure the system at boundaries, minimize trust, and make risky behavior explicit in code, configuration, and review.

When to Activate

• Add a new auth or authorization flow
• Handle user input at an external boundary
• Write database queries or ORM filters
• Review secrets, tokens, or credential handling
• Audit dependencies for known vulnerabilities
• Threat-model a new feature or integration
• Review logging for security-critical events

OWASP Quick Reference