Security work becomes more manageable when it is part of ordinary development. A few repeatable habits can remove entire classes of mistakes before they become incidents.
Validate at the boundary
Treat browser inputs, uploaded files and third-party responses as untrusted. Validate both the shape and the meaning of data on the server. Client-side validation improves the experience, but the server still needs to enforce the rules.
For example, a syntactically valid record identifier does not prove that the current user may read that record.
Authentication is not authorization
Authentication establishes who is making a request. Authorization determines whether that person may perform this action on this resource. Check both on every protected path, including background jobs and API endpoints.
Prefer a small shared authorization function over scattered assumptions. Add a test for a signed-in user trying to access somebody else’s data.
Keep data out of executable contexts
Use parameterized database queries. Render text through your framework’s escaping behavior. Avoid interpolating untrusted strings into HTML, shell commands or executable templates.
// Let the database driver bind the value.
await db.query('SELECT id, title FROM notes WHERE owner_id = $1', [session.userId]);
Make secrets boring
- Keep credentials out of source control and browser bundles.
- Use separate credentials for development and production.
- Give each credential the smallest useful scope.
- Redact tokens from logs and error reports.
- Rotate a credential if it may have been exposed.
An environment variable with a public prefix is designed to reach the browser. It is a configuration mechanism, not a safe place for a secret.
Review the actual attack surface
Keep dependencies current, review externally reachable routes and understand where your application stores user data. For cookies, configure appropriate Secure, HttpOnly and SameSite attributes and evaluate CSRF protection for state-changing requests.
The details depend on the application. Use the OWASP Cheat Sheet Series as a starting point, then verify the behavior in your own system.