Best practices · Security
Secure Coding Best Practices
Opens with creditsA practical guide to secure coding for developers who write server-side code in TypeScript, Node.js or Python. It covers trust boundaries and input validation, injection of every kind, output encoding, safe parsing and deserialization, file uploads, path traversal, server-side request forgery, error handling that fails closed, and dependency hygiene, mapped to the OWASP Top 10:2025 and ASVS 5.0.
Written by Tauseef Fayyaz6 chapters, 22 practicesAbout 21 min21 quiz questionsReviewed 13 October 2026What you will learn
6 chapters · about 21 min
1Treat all input as untrustedWhere input comes from, how to validate it at the boundary, and the canonicalization and size limits that have to happen before any check means anything.4 practices · 5 min
2Injection: keep data out of commandsInjection happens whenever data is concatenated into something an interpreter runs. The fix is the same for every interpreter: use an API that keeps data and commands apart.5 practices · 4 min
- 1Use parameterized queries for every database call
- 2Map identifiers like sort columns to an allowlist
- 3Stop operator injection in document databases
- 4Run programs with an argument list, never a shell string
- 5Apply the same rule to templates, eval, LDAP and expression languages
5 in this chapterOpen this chapter- Output encoding and sanitizationData that is safe in a database can be dangerous in HTML, a URL, a log line or a CSV. Encode for where the data lands, at the moment it lands there.3 practices · 3 minOpens with credits
- Safe parsing and deserializationSome data formats can create objects, run code or fetch files while being parsed. Choose formats and parser settings that only ever produce data.3 practices · 2 minOpens with credits
- Files, paths and outbound requestsUploads, file paths and server-side fetches let input reach the file system and the internal network. Each needs a fixed, allowlisted shape.3 practices · 3 minOpens with credits
- Errors, failure modes and dependenciesCode that fails open, error pages that explain your internals, and packages nobody reviewed. The last chapter covers what happens when things go wrong and what you ship that you did not write.4 practices · 4 minOpens with credits
About this guide
Secure coding is the habit of writing code that still does the right thing when the input is hostile. Most vulnerabilities that reach production are not exotic. They are a query built with string concatenation, a filename used as a path, a URL fetched without checking where it points, or an exception that skips a permission check. Each one is a small decision a developer made while thinking about the happy path. These secure coding best practices are about making the safe decision the default one.
The OWASP Top 10:2025 shows where those decisions go wrong. Injection (A05) maps 37 weaknesses, including SQL injection and cross-site scripting. Broken Access Control (A01) now includes server-side request forgery. Software Supply Chain Failures (A03) and Software or Data Integrity Failures (A08) cover the packages you install and the data you deserialize, and the new Mishandling of Exceptional Conditions (A10) is about code that fails open. The OWASP Application Security Verification Standard (ASVS 5.0) turns those risks into requirements, with chapters on encoding and sanitization (V1), validation and business logic (V2), file handling (V5), secure coding and architecture (V15) and logging and error handling (V16).
This guide follows the path data takes through your code. It starts at the trust boundary, where input arrives, moves through injection and output encoding, then parsing, files and outbound requests, and ends with errors and dependencies. Every practice explains why it matters, what to do and what to avoid, with examples in TypeScript on Node.js and in Python. Authentication, authorization and browser defenses each have their own guide, so this one stays on the code you write between them.
Common questions
What are secure coding practices?
Secure coding practices are habits that keep untrusted data from changing what your code does. The core ones are validating input against an allowlist, using parameterized queries and argument lists instead of string building, encoding output for its context, parsing only data formats, controlling file paths and outbound requests, failing closed on errors, and keeping dependencies reviewed and scanned.
Is input validation enough to prevent SQL injection and XSS?
No. OWASP says validation reduces attack surface but is not the primary defense. SQL injection is stopped by parameterized queries, and XSS by context-aware output encoding and sanitization. Use validation as well, because it rejects bad data early and makes the other defenses easier.
What is the OWASP Top 10:2025?
It is the 2025 edition of OWASP's list of the most critical web application security risks: Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions.
What is the difference between the OWASP Top 10 and ASVS?
The Top 10 is an awareness document that ranks risk categories. ASVS is a verification standard with detailed, testable requirements grouped into chapters and three levels. Use the Top 10 to learn what goes wrong and ASVS to check that a feature is built correctly.
How do I prevent SSRF in a feature that fetches URLs?
Prefer an allowlist of destinations and build the URL yourself. If you must accept arbitrary URLs, resolve the host, reject private, loopback, link-local and metadata addresses for every answer, connect to the address you checked, disable redirects, and restrict outbound traffic at the network level.
Is it safe to use pickle or yaml.load in Python?
Not on data that came from outside your system. Unpickling and full YAML loading can construct objects and execute code. Use JSON or yaml.safe_load for untrusted input, and sign any serialized data you need to accept back from a client.
Sources (8)
Checked against these, last on 13 October 2026.
- OWASP Top 10:2025, OWASPtop10.owasp.org/2025/
- A10:2025 Mishandling of Exceptional Conditions, OWASPtop10.owasp.org/2025/A10_2025-Mishandling_of_Exceptional_Conditions
- OWASP Application Security Verification Standard, OWASPgithub.com/OWASP/ASVS
- Input Validation Cheat Sheet, OWASP Cheat Sheet Seriescheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
- SQL Injection Prevention Cheat Sheet, OWASP Cheat Sheet Seriescheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
- Deserialization Cheat Sheet, OWASP Cheat Sheet Seriescheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
- File Upload Cheat Sheet, OWASP Cheat Sheet Seriescheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html
- Server Side Request Forgery Prevention Cheat Sheet, OWASP Cheat Sheet Seriescheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
Related on Sefism
Picked from the other libraries by shared topics.
Roadmaps
See allCheat sheets
See allBest practices
See all- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
- Authorization Best PracticesGet access control right: deny by default, object-level checks against IDOR, RBAC vs ABAC vs ReBAC, tenant isolation with row-level security, audits and tests.
- Cryptography Best Practices for DevelopersUse cryptography safely in application code: vetted libraries, AEAD and nonces, secure randomness, key management and rotation, TLS settings and the post-quantum move.
Checklists
See all- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
- Web Application Security ChecklistA practical web application security checklist built on the OWASP Top 10:2025 and ASVS 5.0, with a severity and a way to verify every check.
- Linux Server Hardening ChecklistHarden an Ubuntu, Debian or RHEL server step by step: accounts and sudo, SSH, updates, firewall and open ports, permissions, logging and CIS benchmark scans.
Project structures
See all- Firebase (Cloud Functions and security rules) project structureFor students building an app on Firebase who need a real backend: Cloud Functions (2nd gen) in TypeScript, Firestore and Storage security rules with tests, and the Local Emulator Suite. The tree starts from
firebase initand grows into feature folders of callables, triggers and scheduled jobs, then adds CI deploys, environments, contract tests and runbooks. - AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Electron desktop app project structureA desktop notes app for Windows, macOS and Linux, built from the Electron Forge 8 Vite and TypeScript template. The tree starts with the scaffold's three entry files (main, preload, renderer) and grows into separate folders for each process, a typed IPC contract, signed installers, auto-update and end-to-end tests on the packaged app. For students who know web development and want to ship a real desktop app; if a small download matters more than a large JavaScript ecosystem, Tauri is the alternative worth comparing first.
Career questions
See all- How do I get into AI security as a student or junior engineer?Build a normal security or software foundation first, then learn how LLM apps fail using the OWASP Top 10 for LLM Applications and MITRE ATLAS, and prove it by building, testing and hardening a small LLM app of your own. Most people reach AI security through AppSec, security engineering or ML engineering, not straight from university.
- Where do I start if I want a career in cybersecurity or IT operations?Start with the foundations both fields share: networking, Linux, and how systems fail. Then choose an entry role such as SOC analyst, IT support or junior cloud operations, and prove it with hands-on labs and one documented project rather than a stack of certificates.
- Can I use AI coding tools at my internship, and what should I never paste into them?Usually yes, but only the tools your company has approved, on the code and data they allow, and in the way they allow. Ask in your first week. Never paste secrets, customer data or code you are not permitted to share, and review everything the tool writes as if your name is on it, because it is.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com