// Always verify ownership
if (resource.userId !== currentUser.id) {
  throw new ForbiddenException();
}

// Deny by default
const allowed = permissions.includes(requiredPermission);
if (!allowed) throw new ForbiddenException();

// Rate limit sensitive endpoints
app.use('/api/admin/*', adminRateLimiter);

// Security headers
import helmet from 'helmet';
app.use(helmet());

// Strict CORS
app.use(cors({
  origin: ['https://myapp.com'],
  credentials: true
}));

// Hide errors in production
if (process.env.NODE_ENV === 'production') {
  app.use((err, req, res, next) => {
    res.status(500).json({ error: 'Internal error' });
  });
}

# Audit dependencies
npm audit
pip-audit
mvn dependency-check:check

# Use lockfiles
npm ci  # Instead of npm install

# Verify package integrity
npm install --ignore-scripts
npm config set ignore-scripts true

// Strong password hashing
import { hash, verify } from 'argon2';
const hashed = await hash(password, { type: argon2id });

// Secure random
import { randomBytes, randomUUID } from 'crypto';
const token = randomBytes(32).toString('hex');

// AES-256-GCM for encryption (not CBC)

// SQL - use parameterized queries
const user = await prisma.user.findUnique({ where: { id } });
await db.query('SELECT * FROM users WHERE id = $1', [id]);

// Command - use execFile, not exec
import { execFile } from 'child_process';
execFile('ls', ['-la', safeArg]);

// XSS - sanitize HTML
import DOMPurify from 'dompurify';
element.innerHTML = DOMPurify.sanitize(userInput);

// Rate limiting
import rateLimit from 'express-rate-limit';
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5
});

// Secure cookies
res.cookie('session', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict'
});

// Strong passwords (12+ chars, mixed)

// Verify signatures on updates
// Use subresource integrity (SRI)
<script src="lib.js"
  integrity="sha384-..."
  crossorigin="anonymous">
</script>

// Safe deserialization
// Avoid: JSON.parse(untrusted)
// Use: zod/yup validation

// Log security events
logger.warn({
  event: 'auth_failure',
  userId: attemptedId,
  ip: req.ip,
  timestamp: new Date().toISOString()
});

// Events to log:
// - Login success/failure
// - Password changes
// - Permission denied
// - Rate limit exceeded

// Graceful error handling
try {
  await riskyOperation();
} catch (error) {
  logger.error({ error, context });
  // Generic response to user
  throw new InternalServerException('Operation failed');
}

// Never expose stack traces
// Never expose internal paths
// Never expose SQL/DB errors

# Dependencies
npm audit --json
snyk test

# Secrets
gitleaks detect
trufflehog git file://.

# SAST
semgrep --config=p/security-audit .

# Docker
trivy image myimage:latest