Identity & access
- Enforce strong auth (OIDC/JWT); short-lived tokens + refresh; audience/issuer checks.
- Fine-grained authz (RBAC/ABAC); deny-by-default; rate-limit per identity.
Input & data
- Validate/normalize input; reject oversized bodies; JSON schema where possible.
- Output encode; avoid reflecting raw user data; paginate results.
- Store secrets in vault/KMS; rotate keys; never log secrets/tokens.
Transport & headers
- TLS everywhere; HSTS; modern ciphers.
- Security headers:
Content-Security-Policy,X-Content-Type-Options=nosniff,X-Frame-Options=DENY,Referrer-Policy.
Abuse protection
- Rate limit + burst control; CAPTCHA/step-up for sensitive actions.
- Bot detection where relevant; geo/IP allow/deny for admin surfaces.
Observability
- Structured audit logs with identity, action, resource, result; avoid PII spill.
- Alerts on auth failures, unusual rate spikes, and 5xx anomalies.
Checklist
- AuthZ enforced; least privilege.
- Input validated; size limits set.
- TLS + security headers applied.
- Rate limits + abuse controls configured.
- Secrets vaulted and rotated.
