Secure Coding Fundamentals

The mindset

Assume every input is hostile and every component can fail. Security bugs are usually ordinary bugs with security consequences, so build checks into normal development.

Ten practical rules

1. Validate input on the server (type, length, range, allow-lists).
2. Use parameterised queries, never string-built SQL — see web application security fundamentals.
3. Encode output for its context (HTML, attribute, URL, JavaScript).
4. Enforce authorisation on every request; deny by default.
5. Hash passwords with Argon2id or bcrypt, never roll your own crypto — see password security.
6. Keep secrets out of code and git history; use environment variables or a secrets manager. Our Secrets in History challenge shows why.
7. Handle errors safely: fail closed, log details privately, show generic messages to users.
8. Least privilege for database accounts, services and API keys.
9. Update dependencies and watch advisories — vulnerable components cause many incidents (see OWASP Top 10).
10. Log security events, but never secrets.

Example: a safer file name check

import re
ALLOWED = re.compile(r"^[A-Za-z0-9._-]{1,64}$")
def safe_name(name: str) -> str:
    if not ALLOWED.fullmatch(name):
        raise ValueError("invalid file name")
    return name

Allow-lists are safer than trying to block "bad" characters.

Tools that help

Add them to CI so issues are found before release.

Keep learning

The OWASP Secure Coding Practices Quick Reference Guide and ASVS give detailed checklists.