security

Security — Compliance & Protection

Assume breach. Defense in depth. Least privilege everywhere.

Step 0: Detect the Stack

Before advising on specific implementations, identify the project's stack (check package.json, go.mod, Gemfile, pyproject.toml, pom.xml, Cargo.toml). Security principles are universal — the libraries that implement them vary. Always recommend the idiomatic solution for the stack in use, not a JavaScript-specific one.

Security Defaults

Every project ships with:

Control	What to implement
Auth	OAuth 2.0 / OIDC via the standard library for your stack
Sessions	HTTP-only, Secure, SameSite=Strict cookies
Passwords	bcrypt or argon2, min 12 chars, no max limit
API auth	Bearer tokens with expiry, refresh token rotation
CORS	Explicit allowlist, never * in production
HTTPS	Everywhere. No exceptions. HSTS headers.
CSP	Content-Security-Policy header on all pages
Rate limiting	Auth endpoints: 5/min. API: 100/min. Adjust per use.

OWASP Top 10 Quick Reference

Vulnerability	Prevention
Injection (SQL, NoSQL, OS)	Parameterized queries, ORMs, never string concat
Broken Auth	MFA, session timeouts, account lockout
Sensitive Data Exposure	Encrypt at rest + transit, minimize data collection
XXE	Disable external entity processing
Broken Access Control	Check permissions server-side on every request
Security Misconfiguration	Defaults off, hardened configs, no debug in prod
XSS	Output encoding, CSP headers, sanitize HTML
Insecure Deserialization	Validate and type-check all serialized data
Known Vulnerabilities	Dependency audit tool for your stack (npm audit, pip audit, go mod tidy, bundle audit, etc.) + automated updates
Insufficient Logging	Log auth events, access denied, input validation failures

HIPAA Compliance (Health-Tech)

Required if handling PHI (Protected Health Information):

Requirement	Implementation
Encryption at rest	AES-256 for databases and file storage
Encryption in transit	TLS 1.2+ everywhere
Access controls	Role-based, audit-logged, least privilege
Audit trail	Every PHI access logged with who, what, when
BAA	Business Associate Agreement with every vendor touching PHI
Data minimization	Collect only what's clinically necessary
Breach notification	60-day notification requirement — have a plan
Employee training	Annual security awareness training

PHI includes: Names, dates, phone numbers, emails, SSN, medical record numbers, device IDs, biometric data, photos, and any data that could identify a patient.

Vendor checklist:

• Does your cloud provider sign BAAs? (AWS, GCP, Azure: yes. Many others: no.)
• Does your analytics tool see PHI? If yes, need BAA or strip PHI first.
• Does your error tracking capture PHI in stack traces? Strip it.

SOC 2 Basics

Trust Principle	What to Implement
Security	Access controls, encryption, firewalls, IDS
Availability	Uptime monitoring, incident response, backups
Processing Integrity	Input validation, error handling, QA
Confidentiality	Encryption, access logging, data classification
Privacy	Consent, data retention, deletion, privacy policy

Start with: Security + Availability. Add others when customers require it.

Security Review Checklist

When reviewing code for security:

1. Auth on every endpoint? — Not just the route, but the data query too
2. Input validated at boundary? — Use the schema/validation library for your stack before any processing
3. Secrets in env vars? — Never in code, git, or client bundles
4. Queries parameterized? — No string concatenation, no interpolation into SQL or commands
5. Error messages safe? — No stack traces, no internal paths to users
6. Deps up to date? — Run your stack's dependency audit tool
7. Logging sufficient? — Auth events, permission failures, anomalies
8. Data minimized? — Only collecting what's needed, only retaining as long as required