Secure Coding Principles

The wrap only matters through the sink it feeds. A wrapped size drives an undersized allocation that a full-length write then overruns; a wrapped length passes a bounds test and yields out-of-range access; a wrapped total or counter defeats a quota, price or expiry decision. What the value authorises decides the impact.

Rank by reachability × privilege × sensitivity. Ask who can reach the sink, what the executing process can already touch, whether the sink reads, writes or deletes, and whether the result or an error timing leaks. Writes outrank reads because writes become execution.

Safety is a relation between a name and a specific resolver, not a property of the string. So "sanitised" cannot be carried across a boundary: each resolver in the chain is its own boundary, and enforcement belongs adjacent to each sink, expressed in that sink's grammar.

Wiping shortens the window, it does not guarantee erasure: relocating collectors leave stale copies, compilers can delete the wipe, and swap, hibernation, core dumps, copy-on-write forks and hypervisor snapshots copy memory outside your control. The real bound is restricting who can capture process memory.

Map the caller's opaque token to a fixed, code-owned identifier through a lookup table, and reject anything not in the table. Identifiers determine the plan, so they must be resolved before parsing — binding is impossible and quoting is a weak substitute.

Both claims describe a tool, not the invariant. An ORM is safe only where it builds the statement; string fragments and native-query escape hatches are not. A procedure is safe only if its body does not itself assemble dynamic SQL from its arguments. Document databases have the same defect in operator form.

Declare one schema enforced identically at every entry point; impose size, depth, count and expansion limits during parsing, not after; keep free text unmodified and let sinks handle it; identify files by parsing, not by extension; and treat the validator itself as attack surface — bounded regexes, no external entity or schema fetching, reject rather than coerce.

The rule is unchanged — encode for the grammar that will parse the value — but that grammar belongs to a consumer you do not control and may not know. So you use a real serializer for the format, constrain values to a closed set where the consumer's rules are unknowable, and treat every export or log line as a sink with an owner.

Rank by exposure times privilege times data sensitivity, adjusted upward when the credential is shared, unattributable or hard to rotate. Fix in that order: build cheap rotation first, then split shared credentials per principal, narrow scope, shorten lifetime, and only then scan.

Draw the plaintext's path and count the components that can see it. Every hop that terminates a connection, parses, queues, caches, retries or logs holds a cleartext copy. Reduce the count: substitute a reference for the value early, and decrypt only inside the one component that needs it.

Make the unsafe path unrepresentable rather than hunting bugs: one query-construction API that accepts a static template plus bound values, a build-time ratchet so no new concatenation is added, risk-ranked migration of the existing sinks, and least-privilege plus data-level controls to cap blast radius while the work runs.

Stop trying to make the input safe and relocate the trust boundary: execution happens inside a disposable, unprivileged, isolated environment with no ambient credentials, no default egress and hard resource limits. Everything it produces — output, logs, filenames — is then untrusted input to you.

Inventory decode sites and their producers, set a target of schema-first codecs binding into code-chosen types, migrate behind a version tag, and delete the requirement where possible — client blobs become server-side references. Meanwhile: allow-list filters, budgets, least-privileged decoders, banned-API lint.

Default to checked arithmetic that fails fast wherever the value authorises something. Allow saturating only where a clamped value is semantically correct, such as display or back-off caps. Wrapping is opt-in and must be named. Wider types are a range argument, never a fix. Put the guarantee in shared helpers and types, not in review discipline.

Four mechanisms: another decode pass after the check, normalisation or platform mangling applied later, truncation at a layer boundary such as an embedded NUL, and re-resolution over a mutable namespace. The rule: resolve once to a handle, verify the handle, operate on the handle.