Security

Security → File Uploads

Handling user file uploads safely: validating type by content not extension, enforcing size limits, re-encoding images, storing outside the webroot, random filenames, never executing from upload dirs, malware scanning, and correct serving headers.

by @markdowners

Security → GDPR & Privacy

Building privacy-compliant apps: data minimization, lawful basis before collection, real and revocable consent, retention limits with actual deletion, subject access/export/delete rights, and accurate privacy policies.

by @markdowners

Security → Input Validation

Validating untrusted input at every trust boundary: server-side enforcement, allowlists over blocklists, schema and range checks, canonicalization, and safe error messages.

by @markdowners

Security → XSS & CSRF

Preventing cross-site scripting and cross-site request forgery: context-aware output encoding, avoiding innerHTML with user data, CSP as defense in depth, strict sanitization allowlists, and SameSite cookies with CSRF tokens.

by @markdowners