Every published module, all in one place.
7 modules
Project Setup → Env Secrets
Rules for keeping credentials out of git, out of client bundles, and rotatable — so a leak is an inconvenience, not a breach.
by @markdowners
Payments → Other
Foundational rules for handling money safely: server-side pricing authority, idempotent charges, integer currency math, and staying out of PCI scope.
Auth → Other
Core authentication rules every login system needs: password hashing, session revocation, verification, and the line between authentication and authorization.
API & Backend → Rate Limiting
Which endpoints need explicit abuse budgets, how to choose limits per identity axis, and how to respond to breaches without leaking exploitable detail.
Security → File Uploads
Handling user file uploads safely: validating type by content not extension, enforcing size limits, re-encoding images, storing outside the webroot, random filenames, never executing from upload dirs, malware scanning, and correct serving headers.
Auth → Sessions
Keeping an established session safe for its whole lifetime: cookie flags, revocation, CSRF defenses, and concurrent-session visibility.
Security → Input Validation
Validating untrusted input at every trust boundary: server-side enforcement, allowlists over blocklists, schema and range checks, canonicalization, and safe error messages.