Security is not a feature added at the end of a project. It is a set of engineering practices applied from the first design decision. Most security incidents exploit basic weaknesses rather than sophisticated techniques, so getting the essentials right matters most.
Authenticate people properly
- Store passwords using a modern, slow hashing algorithm designed for passwords, never in plain text.
- Offer or require multi-factor authentication, especially for administrators.
- Limit repeated failed sign-in attempts.
- Expire sessions after inactivity and allow users to sign out of all devices.
Authorise every request
Checking who someone is does not tell you what they may do. Every action and every piece of data should be checked against the user’s permissions on the server, not only hidden in the interface.
Encrypt data
Use HTTPS for all traffic. Encrypt sensitive data at rest where appropriate, and protect encryption keys separately from the data they protect.
Validate input
Treat all input as untrusted, including data from forms, files, APIs and integrations. Validate it, use parameterised database queries and encode output correctly so injected code cannot run.
Keep software updated
Frameworks, libraries, operating systems and plugins receive security fixes regularly. Track the components you use and apply updates promptly, prioritising known vulnerabilities.
Limit privileges
Give every user, service and integration the minimum access it needs. Separate administrative functions, and review access when people change roles or leave.
Protect secrets
API keys, passwords and certificates belong in secure configuration or a secrets manager, not in source code, spreadsheets or chat messages.
Log security events
Record sign-ins, failed attempts, permission changes and access to sensitive data. Logs help detect suspicious activity and investigate incidents, but must themselves be protected and must not contain passwords.
Set safe defaults
Configure security headers, disable unused features and debug modes in production, and remove default accounts.
Test and review
Include security checks in code review and automated testing, scan dependencies for known issues and consider independent security testing for systems that handle sensitive information.
Prepare for incidents
Know who to contact, how to contain a problem and how to communicate if something goes wrong. Preparation shortens incidents and reduces their impact.
