security

Security Guidelines

Directives for secure coding. Apply when handling input, identity, secrets, or sensitive data.

---

Input Validation

• Validate all caller-supplied data at the boundary — type, format, range, and length
• Reject invalid input explicitly; do not sanitise and proceed
• Use schema validation (e.g. Zod, FluentValidation) for structured input
• Enforce length limits to prevent buffer overflow and DoS
• Validate file uploads: type allowlist, size limits, and content inspection
• Validate URLs before use: allowlist scheme and host; reject file://, localhost, internal IPs

Parameterised queries only:

-- Good: parameterised
SELECT * FROM users WHERE id = $1
-- Bad: string concatenation
SELECT * FROM users WHERE id = '${id}'

---

Authentication

• Verify identity before checking permissions; never allow partial or anonymous access to sensitive operations
• Hash passwords with bcrypt (salt rounds ≥ 12) or Argon2; never store plaintext
• JWT: use short expiry (≤ 15 min for access tokens); validate issuer, audience, and expiry; use strong secret
• Prefer refresh tokens for session extension; store securely (httpOnly, secure, SameSite)
• Enable MFA for privileged or sensitive operations
• Implement rate limiting on login and password-reset endpoints
• Use constant-time comparison for tokens and secrets

---

Authorisation

• Authorise at the resource level; verify the authenticated user may access the specific resource requested
• Do not rely only on role checks; verify resource ownership in business logic
• Default to deny; require explicit grant for elevated access
• Missing authorisation on one endpoint is an access control failure
• Implement RBAC with least privilege; map roles to permissions explicitly

---

Data Protection

• Encrypt sensitive data at rest (AES-256-GCM) and in transit (TLS 1.2+)
• Use platform-provided crypto; never implement custom algorithms
• Never use MD5 or SHA-1 for security purposes; use SHA-256 or higher
• Store keys in a secrets manager; inject at runtime; rotate on compromise
• Enforce HSTS for web applications
• Use secure defaults: restrict CORS, disable debug in production