principle-backend-security

Apply when adding or touching a request/event boundary, an authn/authz decision, a secret, or a third-party dependency in a backend service. Validate at the edge, enforce the specific least-privilege decision, never hardcode a secret, use parameterized queries, and check new dependencies for known vulnerabilities.