Topic: security
-
Dependency hygiene and software supply-chain checks
Know what you depend on, pin and verify it, watch for known vulnerabilities, and build from trusted sources; SLSA levels, OpenSSF Scorecard and hash-checked installs give concrete steps.
-
Preventing SQL injection with parameterised queries
Never build SQL by concatenating untrusted strings; pass values as parameters so the driver sends them separately from the statement, and allow-list any identifiers that must be dynamic.
-
Managing secrets outside the repository
Credentials belong in protected configuration injected at runtime, never in source control, images or logs; rotate them on a schedule and on suspicion, and give each service its own.
-
Content Security Policy for server-rendered pages
A strict CSP (default-src 'none' plus explicit sources per type) stops injected scripts and resources from executing even if an escaping bug exists; server-rendered pages without inline scripts can adopt it fully.
-
Storing passwords and API keys
Passwords are stored only as salted, slow hashes (Argon2id, scrypt, bcrypt); high-entropy API keys can use a keyed fast hash; both are compared in constant time and never logged or returned after issue.
-
Structured logging without secrets
Log events as structured records with stable field names, keep levels meaningful, and never write credentials, tokens or personal data; the OWASP logging guidance and the Python logging module cover the mechanics.
-
Input validation at trust boundaries
Validate every input where it enters the system: syntactic checks (type, length, format) first, then semantic checks against business rules; prefer allow-lists, reject rather than sanitise, and never trust client-side validation.
Machine-readable: JSON