application-security

Technology-neutral application security discipline - lightweight threat modelling (assets, actors, trust boundaries, STRIDE), OWASP Top 10 categories, input validation and output encoding, authentication and authorisation principles, least privilege, secure defaults, injection, XSS, CSRF, SSRF, logging without sensitive data, defence in depth, fail-closed behaviour, security review checklist, and vulnerability handling and disclosure. Load when designing, building, or reviewing any feature that handles user input, identity, data access, external calls, or secrets.