The 20 rules to check first

These 20 rules catch the problems we find most often in apps built with AI. Check them first, then read the playbook your project needs. They are also in start.json.

• AID-36 Keep secret keys on the server: Never ship a secret key in code that runs in the browser. That covers database secret or service role keys, payment secrets and AI provider keys.
• SEC-33 Keep secrets out of code: Never write a password, key or token into code, settings files in the repo, or its history.
• AID-35 Turn on row-level security for every table: When the browser talks to the database directly, turn on row-level security for every table and write a policy for each action.
• SEC-42 Keep storage buckets private: Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.
• SEC-17 Check ownership on every record: Before returning or changing a record, check on the server that it belongs to the logged-in user or their team.
• SEC-18 Check roles on every action: Check the user's role on the server for every admin or staff action. Hiding a button is not a check.
• AID-37 Check every sign-in and permission flow: Test sign-up, sign-in, password reset and every admin page as a stranger and as a normal user before launch.
• SEC-21 Store passwords with a slow hash: Store passwords only as a slow, salted hash made for passwords, such as Argon2id or bcrypt.
• SEC-20 Slow down password guessing: Limit failed logins per account and per address, and refuse passwords known from breaches.
• SEC-22 Lock down session cookies: Mark session cookies HttpOnly, Secure and SameSite=Lax or Strict. Issue a new session at login and end it at logout, after idle time and after a fixed lifetime.
• SEC-9 Use parameterised queries: Send every database query with placeholders, and pass user input as separate values. Never build a query by joining strings.
• SEC-10 Escape everything you show: Escape untrusted text for the place it lands in a page, and back it up with a strict Content Security Policy.
• API-51 Sign every webhook: Sign each webhook body with a secret shared with the receiver, and include a timestamp, so receivers can reject fakes and replays.
• PAY-18 Let provider events move the order: Fulfil, grant access or mark a refund only when a verified provider event or API read says the money moved. Map each event type to one order transition.
• PAY-5 Keep test and live modes apart: Use the provider's test mode in every environment except production, and make the app refuse to start with a live key anywhere else.
• SEC-36 Close debug and admin doors: Remove debug, test and status tools from production, or put them behind a login and a private network.
• WEB-139 Make browsers always use HTTPS: Send Strict-Transport-Security so browsers always use HTTPS. Give it a long max-age (at least a year) and includeSubDomains, on HTTPS responses only.
• SEC-65 Lock and audit dependencies: Commit a lock file, install from it exactly, and fail the build on known holes in any dependency.
• DAT-28 Prove restores work: Restore a backup on a schedule and check the result. An untested backup is a hope, not a backup.
• OPS-45 Back up off the machine: Copy backups automatically to storage in another place, which an attacker on the server cannot delete.