01
Application security
Controls matched to the system’s users, data, and risk.
- Least privilege
- Role-based access
- Input validation
- Session security
- API authorization
02
Operational security
Production practices that protect reliability and recovery.
- Secret management
- Security headers
- Rate limiting
- Dependency hygiene
- Backups and monitoring
03
Accountability
Make important actions observable without collecting unnecessary data.
- Auditability
- Structured logging
- Access review
- Incident readiness
- Safe error handling