Security Baseline

These are not optional and are not line items to be cut for budget. A breach on a delivered project is a reputational event that no fee compensates for.

Every project#

• HTTPS enforced, HTTP redirects
• Security headers set: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a sensible Permissions-Policy
• All secrets in environment variables
• No secrets in git history
• Dependencies audited before handover — npm audit, resolve high and critical
• Input validated server-side, always. Client-side validation is a convenience, not a control.
• Parameterised queries only — the ORM handles this; do not bypass it with raw string interpolation
• Rate limiting on public write endpoints and auth routes

Projects with authentication#

• Passwords hashed with bcrypt or argon2, never stored or logged in plain text
• Session cookies httpOnly, secure, sameSite
• Session expiry implemented
• Authorisation checked server-side on every protected route — hiding a UI element is not access control
• Each role tested against routes it should not reach
• Password reset tokens single-use and time-limited

Projects handling payments#

• Card data never touches the server — use Stripe Elements or Checkout
• Webhook signatures verified
• Amounts calculated server-side, never trusted from the client
• Idempotency keys on payment operations

Projects handling personal data#

• Collect only what is needed
• Encrypted in transit and at rest
• Deletion mechanism exists
• Client informed of their obligations — they are the data controller

Things that are never acceptable#

• Authorisation implemented only in the frontend
• Secrets in client-side code
• eval on user input
• Disabling certificate verification "temporarily"
• Logging passwords, tokens, or full card details