Data and secrets

Required

• Keep secrets out of code

  Required

  Never write a password, key or token into code, settings files in the repo, or its history.

• Keep secrets out of the browser

  Required

  Send no private key to the browser. Anything in a page, script or source map can be read by anyone.

• Show short errors

  Required

  Show visitors a short error with a reference number. Keep stack traces, queries and file paths in the server log.

• Close debug and admin doors

  Required

  Remove debug, test and status tools from production, or put them behind a login and a private network.

• Serve no hidden files

  Required

  Serve only the files you meant to publish. Never serve version control folders, settings files, backups or folder listings.

• Return only the fields needed

  Required

  Each API reply returns only the fields the caller needs and may see. Never send a whole database record and let the page hide the rest.

• Keep private data out of logs and addresses

  Required

  Never put passwords, tokens, card numbers or personal details in addresses or logs.

• Encrypt data on the wire and on disk

  Required

  Encrypt every connection, including those between your own servers. Encrypt stored personal data and backups.

• Give each key the least power

  Required

  Give every key, account and service only the access it needs. Replace keys at least once a year, and at once after a leak or when someone with access leaves.

• Keep storage buckets private

  Required

  Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.

• Keep card numbers off your servers

  Required

  Never let card numbers reach your servers or your own scripts. Take payments through the provider's hosted checkout or its embedded payment fields.