web-security

name	web-security
description	Enforce web security and avoid security vulnerabilities

Web Security

We treat web security as a core requirement, not an afterthought. Assume hostile input and untrusted environments by default.

Core Principles

• NEVER trust user input
• ALWAYS validate and sanitize data at boundaries
• Prefer secure defaults over configurability

XSS & Injection

• AVOID dangerouslySetInnerHTML and raw HTML injection
• Escape and encode dynamic content properly
• Never interpolate untrusted data into HTML, CSS, or JS contexts

Dependencies & Supply Chain

• Avoid unnecessary packages
• Treat third-party code as untrusted input

General Principles

• Simplicity reduces attack surface
• If unsure, choose the more restrictive option