standardslisted

# AEP Standards Reference ## Security baseline (always on) - **Input:** validate and normalize ALL external input at the boundary (user, network, file, IPC, env). **Output:** encode per sink — HTML, SQL, shell, URL each have their own escaping; one encoder does not fit all. - **Data access:** parameterized queries only. String-built SQL is a finding even in "internal" tools. - **AuthZ:** deny-by-default, enforced server-side on every request; never trust client state, hidden fields, or "the UI doesn't allow it". - **Secrets:** environment variables or a secret manager only — never in code, logs, tests, commits, instruction files, or error messages. Scan the diff for leaked secrets before every commit. - **Dependencies:** audit on add and periodically (`dotnet list package --vulnerable`, `npm audit`, `pip-audit`, per §P.2); pin via lockfiles; a transitive CVE is still your CVE. - **Checklist:** OWASP Top 10 is the minimum review list for any web-facing change — injection, broken auth, broken access control, SSRF, misconfiguration, vulnerable components, integrity failures, logging failures, crypto failures, insecure design. - **Never-disable list:** TLS verification, CORS, CSRF protection, auth checks, or certificate validation are never disabled as a "fix" — not even temporarily, not even in dev configs that could leak to prod. ## Performance & database discipline - **Measure first.** Profile before optimizing; optimize only the measured hot path; keep the benchmark next