One hub for the security pages on this site. Defense in depth: validate input at the boundary, enforce authorization in the database, keep secrets off the client, verify every inbound integration, and harden the transport. Each page lives in its home section; this MOC is the cross-cutting index.
Risk taxonomy
- owasp-top-10: OWASP Top 10:2025 web risks (A01 to A10), each mapped to a page here.
- owasp-llm-top-10: OWASP Top 10 for LLM Applications 2026, plus the Agentic Top 10, mapped to agent-security pages.
Access control and data protection
- supabase-rls: Row Level Security as the boundary when clients hit the database directly.
- auth-sessions: Cookie flags, session vs JWT, refresh-token rotation, CSRF, fixation.
- secrets-and-env: Public vs secret values, client prefixes, Supabase key types, scanning, rotation.
Input validation and injection defense
- python-security: Pydantic validation, parameterized SQL, no
pickle, env secrets, SSRF. - prompt-injection-defense: Treat model input as untrusted and separate instructions from data.
- prompt-injection-defense: Least-privilege tools, confirmation gates, sandboxing, output validation.
- mcp-security: Trust boundaries, tool permissions, and the injection surface of MCP servers.
Integration and API security
- webhooks: HMAC on the raw body, dedup by event ID, fast
2xx, replay protection. - payments-stripe: Raw-body signature checks, idempotency keys, server-side amounts.
Transport and platform
- cloudflare-security-headers: HSTS, CSP, Referrer-Policy, Permissions-Policy via Transform Rules.
Process and launch
- pre-launch-checklist: Day-one breakage plus six security checks: secrets, RLS, rate limits, auth guards, validation, email.
- incident-response: Severities, escalation, and the mitigate-first sequence for breaches and outages.