secure-coding

name	secure-coding
description	Secure coding practices covering input validation, secrets management, and authentication patterns. Activate when: validating user input, managing secrets, implementing authentication, handling authorization, encoding output, applying secure defaults, reviewing code security.

Secure Coding Practices

Input Validation

Validation Strategy

Validate at system boundaries:
1. All user input (forms, query params, headers, file uploads)
2. External API responses (don't trust third-party data)
3. Configuration files loaded at runtime
4. Data read from databases (defense in depth)

Validation approach:
- Allowlist over denylist (define what IS valid, not what isn't)
- Validate type, length, range, format, and business rules
- Reject invalid input — don't try to "fix" it
- Validate on the server side (client-side is for UX, not security)

Common Validations

# Email validation
import re
EMAIL_PATTERN = re.compile(r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$")

def validate_email(email: str) -> str:
    email = email.strip().lower()
    if len(email) > 254:
        raise ValueError("Email too long")
      EMAIL_PATTERN.(email):
         ValueError()
     email


 () -> :
      (qty, ):
         TypeError()
     qty <   qty > :
         ValueError()
     qty


 () -> :
    username = username.strip()
     (username) <   (username) > :
         ValueError()
      re.(, username):
         ValueError()
     username