security-and-hardening

Security and Hardening

Overview

Security-first development practices. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory.

When to Use

• Building anything that accepts user input
• Implementing authentication or authorization
• Storing or transmitting sensitive data
• Integrating with external APIs or services
• Adding file uploads, webhooks, or callbacks
• Handling payment or PII data

Process: Threat Model First

1. Map the trust boundaries. Where does untrusted data cross into your system? HTTP requests, form fields, file uploads, webhooks, third-party APIs, message queues, LLM output.
2. Name the assets. Credentials, PII, payment data, admin actions, money movement.
3. Run STRIDE over each boundary:
   • Spoofing → authentication, signature verification
   • Tampering → integrity checks, parameterized queries, HTTPS
   • Repudiation → audit logging
   • Information disclosure → encryption, field allowlists, generic errors
   • Denial of service → rate limiting, input size caps, timeouts
   • Elevation of privilege → authorization checks, least privilege

The Three-Tier Boundary System

Always Do (No Exceptions)

• Validate all external input at system boundary
• Parameterize all database queries
• Encode output to prevent XSS
• Use HTTPS for all external communication
• Hash passwords with bcrypt/scrypt/argon2
• Set security headers (CSP, HSTS, X-Frame-Options)
• Use httpOnly, secure, sameSite cookies for sessions

Ask First (Requires Human Approval)

• Adding new authentication flows
• Storing new categories of sensitive data
• Adding new external service integrations
• Changing CORS configuration
• Adding file upload handlers
• Modifying rate limiting

Never Do

• Never commit secrets to version control
• Never log sensitive data (passwords, tokens, full credit cards)
• Never trust client-side validation as a security boundary
• Never use eval() or innerHTML with user-provided data
• Never store sessions in client-accessible storage
• Never expose stack traces to users