Cryptography and secrets security

Never implement custom cryptographic primitives or use obsolete algorithms.
Use established libraries, authenticated encryption, secure randomness, and verified signatures and certificates.
Treat tokens, private keys, connection strings, and credentials as secrets; keep them out of source, URLs, command lines, logs, fixtures, and frontend code.
Use environment-appropriate secret storage, separate environments, and rotate compromised credentials.