Security and Hardening

Overview

Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.

When to Use

• Building anything that accepts user input
• Implementing authentication or authorization
• Storing or transmitting sensitive data
• Integrating with external APIs or services
• Adding file uploads, webhooks, or callbacks
• Handling payment or PII data

Integration boundaries

Code blocks are independent sketches with missing application imports/adapters, not a complete tested server. Review executable code before running it, use isolated synthetic fixtures, and bound provider/network/production effects to user authority. Runtime validation, tenant checks, authorization, CSRF, output allowlists and atomic write predicates belong in the actual implementation. A green scanner/checklist is not security certification.