---
description: Security baseline for all code — no hardcoded secrets, parameterized queries, input validation, secure auth, dependency hygiene. Universal across phases.
---

# Security Standards

Security is a constraint, not a feature. These rules apply to all code.

## Secrets Management

- ZERO hardcoded secrets: API keys, passwords, tokens, connection strings
- Use environment variables or a secret manager
- `.env` files never committed — use `.env.example` with placeholders
- Rotate any secret that was ever exposed in version control

## Database Security

- Parameterized queries for ALL database access — no string concatenation
- Use an ORM or query builder that parameterizes by default
- Principle of least privilege for database users

## Input Validation

- Validate all user-facing input at the boundary
- Whitelist valid input rather than blacklisting bad input
- Validate type, length, range, and format
- Reject unexpected fields — don't silently ignore them

## Web Security

- No `*` CORS in production; CSP, HSTS, X-Content-Type-Options, X-Frame-Options headers required
- CSRF tokens on all state-changing endpoints; sanitize all HTML output

## Data Protection

- Sensitive data (PII, credentials, tokens) never in logs or error messages
- Never return sensitive data in API error responses
- Encrypt sensitive data at rest where applicable

## Dependencies

- Check for known CVEs before adding any new dependency
- Pin dependency versions — no floating ranges in production
- Audit periodically (`npm audit`, `pip-audit`)

## Authentication and Authorization

- Use established libraries (don't roll your own auth/crypto)
- Session tokens: HttpOnly, Secure, SameSite attributes
- Rate limiting on auth endpoints