security-and-hardening

为代码提供安全加固建议，防范输入、认证、存储与第三方集成等常见漏洞。

在有用户输入、会话管理或第三方集成的地方做代码加固，找出并修补注入、认证绕过、敏感数据泄露等常见漏洞。适合开发新功能、处理未信任数据或上线集成时运行。原则是把外部输入当敌人、把 secret 当珍宝、把授权检查当必需，让安全成为每行触及用户数据代码的约束。

# Security and Hardening

## Overview

Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.

## When to Use

- Building anything that accepts user input
- Implementing authentication or authorization
- Storing or transmitting sensitive data
- Integrating with external APIs or services
- Adding file uploads, webhooks, or callbacks
- Handling payment or PII data

## Process: Threat Model First

Controls bolted on without a threat model are guesses. Before har