Secure Coding

---
name: Secure Coding
description: Never trust input; minimize trust surface.
---
# Secure Coding

Treat every boundary (network, user, file, other service) as untrusted. Most vulnerabilities are a failure to apply this at one specific spot.

## Rules
- **Input validation at the boundary.** Parse, validate, and canonicalize as soon as data enters. After that, trust the in-memory type. Late validation scattered through business logic is inconsistent by construction.
- **Parameterize, never concatenate.** SQL, shell, and HTML are injection vectors. Use parameterized queries and escaping APIs. Never build these by string concatenation.
- **Secrets are data, not code.** Read them from a vault/env at runtime. Never log them. Never commit them.
- **Authz, not just authn.** Authentication says who you are; authorization says what you may do. Check the latter on every sensitive action — IDOR (accessing others' resources by changing an ID) is one of the most common bugs.
- **Fail closed.** On error, deny by default. A try/catch that swallows and proceeds often proceeds past a security check.