Skip to content

secure-coding-standards-guidelines.mdx

Latest commit

 

History

History
71 lines (58 loc) · 3.04 KB

secure-coding-standards-guidelines.mdx

File metadata and controls

71 lines (58 loc) · 3.04 KB
Raw
title Secure Coding Standards | SEAL
description Secure coding standards: validate inputs with allowlists, encode output, authenticate and authorize correctly, handle errors safely, and protect sensitive data.
tags
Engineer/Developer
Security Specialist
contributors
role users
wrote
role users
reviewed
role users
fact-checked

import { TagList, AttributionList, ContributeFooter } from '../../../components'

Secure Coding Standards and Guidelines

🔑 Key Takeaway: Shared coding standards reduce common vulnerability classes when teams enforce them in review and tooling—not only in a wiki page.

Secure coding standards and guidelines help developers avoid common vulnerability classes and keep security visible at every stage of development. Adopt language- and stack-specific rules on top of these general controls.

Secure coding standards

  1. Input validation
    • Validate all inputs against expected formats and ranges.
    • Prefer allowlisting (only known-good inputs) over blocklisting alone.
  2. Output encoding
    • Encode output appropriate to the sink (HTML, SQL parameters via APIs, etc.).
    • Prefer frameworks and libraries with built-in safe encoding or parameterized interfaces.
  3. Authentication and authorization
    • Use strong authentication appropriate to the risk (see IAM).
    • Enforce authorization checks on every privileged action—not only at the UI edge.
  4. Error handling
    • Handle errors without leaking secrets, stack traces, or internal paths to users.
    • Log detail securely for operators; show generic messages to end users.

Guidelines

  1. Use secure libraries and frameworks
    • Prefer maintained libraries with a security track record and update cadence.
    • Avoid deprecated or abandoned dependencies (see Supply Chain).
  2. Follow least privilege
    • Grant code and service accounts only the access they need.
    • Avoid running unrestricted privileges “for convenience.”
  3. Secure data storage
    • Protect sensitive data at rest and in transit with appropriate cryptography (Encryption).
    • Store credentials and secrets in purpose-built secret stores—not source control.
  4. Regular code reviews
    • Review for security issues as part of normal merge process (Code Reviews and Peer Audits).
    • Use automated analysis to complement—not replace—human review.
  5. Continuous security training
    • Keep developers current on relevant vulnerability classes and internal standards.
    • Encourage participation in security communities and learning paths (Awareness).

Further reading