Build security in from the start. These tips help reduce common vulnerabilities and strengthen your delivery pipeline.
Top tips for secure software
- Input handling — validate on the server; prefer allow-lists; never trust client-side checks alone.
- Use parameterised queries/ORM — prevent SQL/NoSQL injection; avoid string-built queries.
- Authentication & sessions — use well-maintained libraries; enforce MFA for admin users; set secure cookie flags; short session lifetimes.
- Authorisation — check permissions server-side on every action; avoid relying on hidden fields or UI state.
- Secrets management — keep keys, API tokens and connection strings out of code; use vaults or platform secrets; rotate regularly.
- Dependency hygiene — pin versions; use SCA tools; update quickly on critical CVEs; prefer reputable packages.
- Code scanning — enable SAST/linters in CI; add DAST for web endpoints; treat “high” findings as blockers.
- Logging & observability — structured logs with unique IDs; no sensitive data; centralise and alert on anomalies.
- Rate limiting & abuse protections — throttling, CAPTCHA as needed, lockouts with care (avoid easy DoS).
- Secure file handling — validate MIME/extension, size limits, store outside web root, scan uploads.
- Cryptography — use platform libs; modern TLS; strong password hashing (e.g., Argon2/bcrypt/scrypt) with salt.
- Content security — Content Security Policy (CSP), output encoding, same-site cookies; protect against XSS/CSRF.
- Containers & cloud — minimal base images, run as non-root, scan images; least-privilege IAM roles; separate envs.
- Build pipeline security — MFA on Git hosting; branch protection; code reviews; signed commits/tags; protect CI secrets.
- SBOM & release integrity — generate an SBOM; sign artefacts; keep a reproducible build path.
- Secure defaults — deny by default; explicit CORS; tight timeouts; safe error messages.
- Privacy & data minimisation — collect only what you need; encrypt at rest/in transit; define retention.
- Incident playbooks — rollback strategy, feature flags, kill-switches, and a runbook for hotfixes.
- Document and automate — security checklists in PR templates; golden pipelines; template repos with baselines.