Security Principles

Code MUST adhere to these security requirements:

Input & Output

1. No SQL Injection - All database queries MUST be parameterized. Never concatenate user input into SQL strings.

1. No XSS (Cross-Site Scripting) - All output MUST be properly escaped/encoded for the context (HTML, JavaScript, URL, CSS).

1. No Command Injection - Never pass user input directly to shell commands. Use safe APIs or strict validation.

Authentication & Authorization

1. No CSRF - State-changing requests MUST require valid CSRF tokens.

1. Secure Authentication - Use strong password hashing (bcrypt/argon2), implement rate limiting, support MFA.

1. Least Privilege - Grant minimal permissions required. Never run as root/admin unless necessary.

Data Protection

1. Secure Defaults - Fail closed, not open. Default to denying access.

1. Sensitive Data Handling - Never log passwords, tokens, or PII. Use encryption at rest and in transit.

1. Secure Session Management - Use secure, httpOnly cookies. Regenerate session IDs on privilege changes.

Defense in Depth

1. Input Validation - Validate ALL user input server-side. Client-side validation is for UX only.

1. Error Handling - Never expose stack traces or internal details to users.

1. Dependency Security - Audit dependencies for known vulnerabilities. Keep packages updated.

Checklist

When reviewing code, verify:

• No hardcoded secrets or credentials
• All inputs validated and sanitized
• All outputs properly encoded
• Authentication properly implemented
• Authorization checks on all protected resources
• Secure communication (HTTPS, TLS)
• Proper error handling without info leakage
• Logging without sensitive data exposure