Security habits for developers who ship

Most application security failures are not exotic. They are secrets in repositories, missing authorization checks, unsafe queries and session cookies that JavaScript can read. Defaults matter more than heroics.

Five defaults worth adopting this week

• Never commit a secret. Scan diffs; rotate anything that leaves your machine.
• Authorize every request on the server. A hidden button is not an access control.
• Parameterise queries and encode output at the rendering boundary.
• Set httpOnly, secure, sameSite cookies for sessions and require a fresh check for sensitive changes.
• Keep dependencies and base images updated; remove packages you no longer use.

// The server owns the decision
if (!session || !canEditCourse(session.user, courseId)) {
  return response.status(403).json({ error: 'FORBIDDEN' })
}

// Data stays data
db.query('select * from lessons where course_slug = $1', [slug])