# Security

- Never hardcode secrets, API keys, passwords, or tokens in source code
- Never use string concatenation in SQL/NoSQL queries (use parameterized queries)
- Never trust user input (validate and sanitize at all entry points)
- Ensure all endpoints have authentication and authorization checks
- Ensure sensitive data is not logged (passwords, tokens, PII)
- Ensure cookies use httpOnly, secure, and sameSite flags
- Ensure JWT tokens have expiration
- Secret patterns defined in .claude/shared/secret-patterns.json