Treat external data as untrusted
Security begins at application boundaries. User input, HTTP requests, uploaded files, database data from other systems and external API responses should not automatically be considered safe or correctly shaped.
Avoid common injection problems
Use parameterized SQL instead of string-built queries. Do not execute untrusted strings with eval() or exec(). Validate file paths, restrict permissions and use appropriate encoding or escaping for the context in which output is displayed.
Protect the operational environment
Keep secrets outside source control, minimize application privileges, update dependencies and disable debug features in production. Authentication and authorization are different: proving who a user is does not automatically prove what that user may do.
Practice: review a small API and produce a security checklist covering input validation, authentication, authorization, secrets, SQL and logging.