dev-secure-codinglisted

# Secure Coding Most vulnerabilities are not clever. They are ordinary code written the ordinary way, by someone who was thinking about the feature and not about the input. The fix almost always costs less at write time than at any point afterwards — a parameterized query is not harder to write than a concatenated one, it just has to occur to you first. This skill exists to make it occur to you first. It covers three things that account for the overwhelming majority of findings in real codebases: 1. **Dependencies** — not pulling in a library that arrives already vulnerable or abandoned. 2. **Code patterns** — writing the shape that static analysis (and attackers) won't flag. 3. **Secrets** — never in the source, always from the environment, failing loudly when absent. It is about writing code. Deployment, pipelines, and platform configuration are out of scope. ## How to use this Apply the transversal rules below — they hold in every language. Then read the reference for the stack you are writing in, **before** writing the code, not after: - `references/python.md` — FastAPI, SQLAlchemy, subprocess, file handling, pydantic-settings - `references/go.md` — database/sql, os/exec, net/http clients, filepath, env config - `references/react.md` — rendering untrusted values, tokens in the browser, what never belongs in a bundle - `references/angular.md` — template binding, sanitization, HTTP interceptors, route guards - `references/dependencies.md` — how to decide whether a li