Web Security Best Practices

Application-level security guidance for WordPress (PHP), Laravel (PHP), Django (Python), FastAPI (Python), and Plotly Dash (Python/Flask).

Important

• Always treat user input as untrusted, including callback inputs in Dash
• Use framework security features instead of custom implementations
• Validate server-side even when client-side validation exists
• Fail securely — errors must not expose system details
• Keep dependencies updated and audited

OWASP Top 10 (2021)

The current OWASP Top 10 categories that this skill addresses:

1. A01 Broken Access Control — See references/authentication-csrf.md
2. A02 Cryptographic Failures — See references/secure-data-handling.md
3. A03 Injection — See references/sql-injection.md, references/xss-prevention.md