security-and-hardening

1# Security and Hardening
2 
3## Overview
4 
5Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.
6 
7## When to Use
8 
9- Building anything that accepts user input
10- Implementing authentication or authorization
11- Storing or transmitting sensitive data
12- Integrating with external APIs or services
13- Adding file uploads, webhooks, or callbacks
14- Handling payment or PII data
15 
16## Process: Threat Model First
17 
18Controls bolted on without a threat model are guesses. Before hardening, spend five minutes thinking like an attacker:
19 
201. **Map the trust boundaries.** Where does untrusted data cross into your system? HTTP requests, form fields, file uploads, webhooks, third-party APIs, message queues, and **LLM output** — plus the local values that look internal because the OS handed them to you: another process's command line or environment, filenames on a shared volume, a path in a job payload. Trust follows who *wrote* a value, not which channel delivered it. Every boundary is attack surface.
212. **Name the assets.** What's worth stealing or breaking? Credentials, PII, payment data, admin actions, money movement.
223. **Run STRIDE over each boundary** — a quick lens, not a ceremony:
23 
24| Threat | Ask | Typical mitigation |
25|---|---|---|
26…