Security-related code must follow the specifications below.
Before coding
Identify the attack surface and trust boundaries first, then write code.
Authentication and keys
- Passwords: bcrypt/argon2 hashing, irreversible storage
- JWT: set an expiration time, use RS256 or HS256, do not store sensitive data in the payload
- Keys/API keys: environment variables or a secret management service, do not hardcode
- Do not commit .env to version control (.gitignore)
- Apply the principle of least privilege to API keys
Input validation
- All external input (users, APIs, files) must be validated
- Whitelists are better than blacklists
- SQL: parameterized queries, do not concatenate strings
- File uploads: validate type, size, and content; do not trust file extensions
Output protection
- XSS: output encoding, set CSP headers
- CSRF: token validation
- Sensitive data: transmit over HTTPS, encrypt at rest, do not log
- Error messages: do not expose internal implementation details to users
Access control
- Principle of least privilege
- Check resource ownership (do not check only roles)
- Path traversal: normalize paths, restrict access scope
Delivery checks
- No hardcoded keys/passwords
- All user input validated
- SQL uses parameterized queries
- Sensitive data is not in logs
- Authentication tokens have an expiration time