Skip to main content
Security controls must be enforced by the backend and deployment environment, not only by storefront UI behavior.

Application security

  • Require HTTPS outside local development.
  • Authenticate protected requests and authorize each action/resource.
  • Enforce tenant isolation and object ownership checks.
  • Validate and normalize all client input.
  • Use parameterized database access and safe ORM query construction.
  • Rate-limit authentication, OTP, password reset, and sensitive endpoints.
  • Protect against CSRF where cookie-based sessions are used; configure CORS narrowly.
  • Verify webhook signatures and reject replayed events where supported.
  • Validate uploaded file contents and storage permissions.

Secrets and credentials

The repository template includes JWT and cryptographic secret settings, database credentials, mail credentials, and cloud-storage credentials. Generate unique secrets per environment, store them outside source control, rotate them, and revoke exposed credentials promptly.

Operational security

Patch supported runtimes/dependencies, restrict network access, protect monitor/API documentation routes, enable database backups/encryption, and centralize security-relevant audit logs. Redact tokens, passwords, payment details, and personal data.

Verification

Run dependency scanning, static analysis, API authorization tests, upload tests, and deployment configuration reviews. Test negative cases (unauthorized, cross-tenant, expired token, malformed payload) as carefully as successful flows.