Security

Security is a default posture, not a feature you add later. Two rules underpin everything:

1. Never trust input — validate on the server, at the boundary, every time.
2. Fail closed — on any doubt (auth, config, verification), deny.

Lean on your framework's built-in protections first; only hand-roll when you understand the gap.

Input validation

• Validate on the server — client validation is UX, not security.
• Allowlist, not denylist: accept known-good shapes (type, length, range, format, enum) and reject the rest. Use a schema validator (Zod, etc.).
• Validate and normalize (canonicalize) before checks to defeat encoding tricks.
• Bound everything: clamp numbers, cap string/array lengths, restrict file types/sizes.

Output encoding — stop XSS