SECURE DEVELOPMENT
Security Coding Rules
Apply authorization, validation, secret management, tenant isolation, and secure defaults to every change.
Production stability and security notice
Development changes must preserve working functionality, Provider isolation, role-based access, HIPAA auditability, released Mobile compatibility, and integration stability. Never deploy AI-generated or unreviewed code directly to production.
Mandatory Controls
| Topic | Standard |
|---|---|
| Authentication | Verify user identity before protected operations. |
| Authorization | Check role, permission, Provider scope, and resource ownership. |
| Input validation | Reject malformed, unexpected, or unsafe input. |
| Output control | Return only the minimum data required. |
| Secrets | Use environment variables or approved secret storage. |
| Password handling | Never log, return, or store plain-text passwords. |
| Uploads | Validate type, size, ownership, and storage destination. |
| Exports | Audit sensitive exports and restrict access. |
Prohibited Patterns
- Hard-coded Provider names or IDs in production logic.
- Client-controlled Provider scope.
- Catch blocks that hide security errors and continue.
- Logs containing passwords, tokens, SSNs, or full PHI payloads.
- Unrestricted support impersonation.
- Public access to private storage paths.