security-and-hardening

Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems. Not all audit findings require immediate action. Use this decision tree: Key questions: When you defer a fix, document the reason and set a review date. Always check before committing: For detailed security checklists and pre-commit verification steps, see references/security-checklist.md . After implementing security-relevant code: - Building anything that accepts user input - Implementing authentication or authorization - Storing or transmitting sensitive data - Integrating with external APIs or services - Adding file uploads, webhooks, or callbacks - Handling payment or PII data - Validate all external input at the system boundary (API routes, form handlers) - Parameterize all database queries — never concatenate user input into SQL - Encode output to prevent XSS (use framework auto-escaping, don't bypass it) - Use HTTPS for all external communication - Hash passwords with bcrypt/scrypt/argon2 (never store plaintext) - Set security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) - Use httpOnly, secure, sameSite cookies for sessions - Run npm audit (or equivalent) before...