Security baseline

Apply this baseline to every code, configuration, infrastructure, or review task.

Treat external input as untrusted and validate at trust boundaries.
Prefer secure defaults, least privilege, explicit authorization, and fail-closed behavior.
Never hardcode, commit, log, expose, or weaken protections for secrets and credentials.
Use established framework and platform security mechanisms; do not invent cryptography or bypass validation, authentication, authorization, or TLS checks.
Keep dependencies minimal and from trusted sources.
Do not disclose sensitive data or internal implementation details in user-facing errors or diagnostics.
Load the applicable focused security rule before changing authentication, web/UI, APIs, databases, files, network access, cryptography, secrets, or supply-chain configuration.