MayR Labs Security Doctrine: Backend

Purpose

To fortify server-side applications, APIs, and databases against injection, unauthorized access, and mass data extraction.

Audience

Backend engineers and AI agents scaffolding APIs, servers, or database schemas.

Core Rules & Constraints

1. Input Validation & Sanitization

• Strict Typing: All incoming requests (params, body, headers, queries) must be validated using robust parsing libraries (e.g., Zod, Joi).
• Reject Unrecognized Data: Strip or reject properties that are not explicitly defined in the schema.