Common Security Standards

Security Standards

Priority: P0 (CRITICAL)

Always-Apply Rules

Apply these on every code write, regardless of context:

• No hardcoded secrets: Use environment variables or secret managers. Never commit keys, passwords, or tokens to source control.
• No raw SQL strings: Use parameterized queries or ORMs — WHERE id = ${userId} always wrong.
• No stacktraces in prod: Return generic error codes; log full detail server-side only.

Workflow

Activate when: implementing auth, encryption, authorization, input handling, or any security-sensitive feature.

• Identify trust boundaries — map every data entry point (API, UI, CSV, webhook).
• Validate and sanitize all external input at each boundary.
• Apply least privilege to users, services, and containers.
• Verify with SAST/DAST scanners in CI before merge.

Context-Specific Rules

Data Safeguarding

• Zero Trust: Never trust external input. Sanitize and validate every data boundary.
• Least Privilege: Grant minimum necessary permissions to users, services, and containers.
• Encryption: AES-256 for data-at-rest; TLS 1.3 for data-in-transit.
• PII Logging: Never log PII (email, phone, names). Mask sensitive fields before logging.

See implementation examples for parameterized queries and secret management.

Secure Coding

• Injection Prevention: Use parameterized queries or ORMs to stop SQL, Command, and XSS injections.
• Dependency Management: Regularly scan (npm audit, pip audit) and update third-party libraries to patch CVEs.
• Secure Auth: Implement Multi-Factor Authentication (MFA) and secure session management.
• Error Privacy: Never leak stack traces or internal implementation details to end-user.

Continuous Security

• Shift Left: Integrate security scanners (SAST/DAST) early in CI/CD pipeline.
• Data Minimization: Collect and store only minimum data required for business logic.
• Audit Logging: Maintain logs for sensitive operations (Auth, Deletion, Admin changes).

Anti-Patterns

• No default passwords: Force rotation on first use with strong entropy requirements.

References

• Injection Testing Protocols (SQLi/HTMLi)
• Vulnerability Remediation & Secure Patterns

Remediation anchors

• Remediation anchors: Argon2id, parameterized queries or ORM, rate limiting, HttpOnly Secure cookies