Security Practices

This is a coding-time baseline, not just an audit checklist — /security-review catches what slips through, but the target is that little slips through.

Auth: managed provider by default, hand-roll only with a reason

Default to a managed auth provider (Supabase Auth, Clerk, Auth0, or the platform's native auth) — don't hand-roll session/token handling, password hashing, or MFA. Hand-rolling is justified only when a specific constraint forces it: a highly custom auth flow the provider can't express, a hard no-third-party-dependency requirement, or genuine data-residency/compliance constraints. Absent one of those, reaching for a managed provider is the default, not a decision to re-litigate per project.

Secrets: .env + platform env vars