Harden

Security as a constraint on every line that touches user data, auth, or external systems. Proactive: applied during implementation, not after. Reactive scans belong to safe-repo (sensitive data) and deps-audit (CVEs).

Ask first — human approval required

• New authentication flow or auth logic changes
• Storing new categories of sensitive data (PII, payment)
• New external service integrations
• CORS configuration changes
• File upload handlers
• Rate-limit / throttling changes
• Granting elevated permissions or roles

Validate at the boundary

Validate at the system boundary (route handler, message consumer), not in business logic: a schema validator (Zod, Joi, pydantic, …) defines the contract; reject with 422 + structured error before business logic touches the data. Trust internal code; validate only at the edges.

Defaults that are easy to forget

• Authorization per resource (ownership), not just authentication
• Queries parameterized; shell commands take argument arrays, never strings built from input; output encoded for its context (HTML, URL, JS)
• Passwords hashed with argon2, scrypt, or bcrypt; reset tokens single-use and short-lived
• OAuth with PKCE and state; redirect targets from an allowlist, never a raw user-supplied URL
• Third-party scripts pinned with Subresource Integrity hashes
• Session cookies httpOnly + secure + sameSite; auth tokens never in localStorage
• Strip sensitive fields from API responses by default
• Security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
• Rate limit on auth endpoints
• Logs and error responses free of secrets, tokens, PII, stack traces
• File uploads: allowlist MIME types, enforce max size before processing, check magic bytes when the type matters, store outside the webroot
• Outbound requests: allowlist destinations; never fetch a user-provided URL unvalidated (SSRF)
• CORS: explicit origin allowlist from config; no wildcard on authenticated endpoints
• External integrations: verify webhook signatures, time out every external call, validate third-party response shapes before use; never deserialize untrusted input with unsafe loaders
• Log security events (auth failures, access denials, input rejections) — without the payloads
• Raw HTML from users only through a sanitizer (DOMPurify or equivalent)

AI / LLM features

• Model output is untrusted input: validate it before it reaches eval, SQL, a shell, innerHTML, or a file path
• The prompt is not a security boundary; enforce permissions in code (prompt injection)
• No secrets or other tenants' data in prompts or retrieved context
• Agent tools scoped to the task; a human confirms destructive actions
• Token, rate, and recursion limits on every model call

Verification

After security-relevant code: deps-audit shows no critical/high CVEs (or each documented with review date); safe-repo --diff clean; headers present (curl -I); authz checked on every protected endpoint.