defense-in-depth-validation

name	Defense-in-Depth Validation
description	Validate at every layer data passes through to make bugs impossible
when_to_use	when invalid data causes failures deep in execution, requiring validation at multiple system layers
version	1.1.0
languages	all

Defense-in-Depth Validation

Overview

When you fix a bug caused by invalid data, adding validation at one place feels sufficient. But that single check can be bypassed by different code paths, refactoring, or mocks.

Core principle: Validate at EVERY layer data passes through. Make the bug structurally impossible.

Why Multiple Layers

Single validation: "We fixed the bug" Multiple layers: "We made the bug impossible"

Different layers catch different cases:

• Entry validation catches most bugs
• Business logic catches edge cases
• Environment guards prevent context-specific dangers
• Debug logging helps when other layers fail

The Four Layers

Layer 1: Entry Point Validation

Purpose: Reject obviously invalid input at API boundary

 () {
   (!workingDirectory || workingDirectory.() === ) {
      ();
  }
   (!(workingDirectory)) {
      ();
  }
   (!(workingDirectory).()) {
      ();
  }
  
}