14 docs tagged with "security"

Engineering guide for session management, JWT, OAuth 2.0, and SAML across all services and third-party integrations.

Engineering guide for configuring Cross-Origin Resource Sharing safely — explicit origin whitelisting, credential policy, and header configuration across all APIs.

Engineering guide for validating, masking, and handling Primary Account Numbers (PANs) in compliance with ISO/IEC 7813 and PCI DSS.

Engineering guide for pinning dependencies to explicit versions, committing lockfiles, and maintaining a secure software supply chain.

Engineering guide for encrypting data at rest and in transit across all systems using AES-256 and TLS 1.2+.

Engineering guide for returning a unified JSON error payload to clients and preventing internal details from leaking through API responses.

Engineering guide for choosing between UUID v7 and auto-incrementing integer IDs in databases and APIs.

Engineering guide for preventing SQL, NoSQL, and command injection through parameterized queries, ORM sanitization, and strict input validation.

Engineering guide for structured logging, log levels, and PII masking across all services.

Engineering guide for defining, validating, and storing media types (MIME types) for file uploads, API responses, and data transit.

Engineering guide for enforcing rate limits on login, payment, and checkout endpoints to prevent brute-force attacks and systemic abuse.

Engineering guide for implementing Role-Based Access Control and the Principle of Least Privilege across all services and APIs.

Engineering guide for storing and accessing credentials, API keys, and sensitive configuration using approved vault managers — never hardcoded in source code.

Engineering guide for storing authentication tokens safely — why LocalStorage is forbidden and how to configure secure HttpOnly cookies correctly.