Secure Coding Best Practices

What this best practices guide is

A practical guide to secure coding for developers who write server-side code in TypeScript, Node.js or Python. It covers trust boundaries and input validation, injection of every kind, output encoding, safe parsing and deserialization, file uploads, path traversal, server-side request forgery, error handling that fails closed, and dependency hygiene, mapped to the OWASP Top 10:2025 and ASVS 5.0.

It has 6 chapters and 22 practices, each with why it matters, what to do and what to avoid. For developers who write backend and full-stack code.

Chapter by chapter

1. Treat all input as untrusted (4 practices)

Where input comes from, how to validate it at the boundary, and the canonicalization and size limits that have to happen before any check means anything.

2. Injection: keep data out of commands (5 practices)

Injection happens whenever data is concatenated into something an interpreter runs. The fix is the same for every interpreter: use an API that keeps data and commands apart.

3. Output encoding and sanitization (3 practices)

Data that is safe in a database can be dangerous in HTML, a URL, a log line or a CSV. Encode for where the data lands, at the moment it lands there.

4. Safe parsing and deserialization (3 practices)

Some data formats can create objects, run code or fetch files while being parsed. Choose formats and parser settings that only ever produce data.

5. Files, paths and outbound requests (3 practices)

Uploads, file paths and server-side fetches let input reach the file system and the internal network. Each needs a fixed, allowlisted shape.

6. Errors, failure modes and dependencies (4 practices)

Code that fails open, error pages that explain your internals, and packages nobody reviewed. The last chapter covers what happens when things go wrong and what you ship that you did not write.

How it works on Sefism

The guide reads like a short course: a syllabus, then one chapter per page in a focused reader, with a quiz at the end of each chapter for members. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.

Every claim is checked against the sources listed on the page (8 cited).