security-and-hardening

针对输入、认证、存储与集成等环节强化安全与防护措施。

在处理用户输入、认证、数据存储或第三方集成时，把代码做硬化和防护，防止注入、越权和泄密等常见漏洞。适合任何接收不可信数据、管理会话或与外部服务交互的功能上线前使用。特别之处在于把安全当成每一行代码的约束：输入校验、密钥管理、最小权限与授权检查都要落实。

# Security and Hardening

## Overview

Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.

## When to Use

- Building anything that accepts user input
- Implementing authentication or authorization
- Storing or transmitting sensitive data
- Integrating with external APIs or services
- Adding file uploads, webhooks, or callbacks
- Handling payment or PII data

## Process: Threat Model First

Controls bolted on without a threat model are guesses. Before har