Secure coding basics

Why security analysts need this

You do not need to be a full-time developer to work in security, but you will review scripts, read code in incident investigations, write automation in Python, and explain fixes to developers. Knowing a few secure coding habits lets you spot the bugs behind most web incidents.

1. Never trust input

Input is anything that comes from outside your code: form fields, URL parameters, headers, cookies, uploaded files, API calls, even data from your own database that a user once typed. Treat it as possibly hostile.

Validation means checking input matches what you expect before using it. An allow-list (only these characters, this length, this format) is much safer than a block-list (block these "bad" words), because attackers find what you forgot to block.

import re

def valid_pincode(text):
    return re.fullmatch(r"[1-9][0-9]{5}", text) is not None

print(valid_pincode("560001"), valid_pincode("56000"), valid_pincode("560001; DROP"))

2. Encode output for where it goes

The same text must be treated differently depending on where it ends up: HTML, a URL, SQL, a shell command or a log. For HTML, encoding turns special characters into safe versions, so a comment containing <script> is shown as text rather than run.

import html

comment = '<script>alert("hi")</script> Nice post!'
print(html.escape(comment))

3. Parameterised queries and safe commands

Use ? or named placeholders for SQL (previous lesson). For operating system commands, avoid building a command string from input; pass a list of arguments to subprocess with shell=False, and validate the input first.

4. Secrets stay out of code

• Never hard-code passwords, API keys or tokens in source code. Code is copied, shared and pushed to Git, and secrets leak with it.
• Read secrets from environment variables or a secrets manager.
• If a secret was ever committed, consider it leaked: rotate (change) it, do not just delete the line.
• Add secret scanning to your Git hosting so pushes with keys are blocked.

5. Errors and logs

• Show users a short, friendly error; write details to the server log.
• Never log passwords, OTPs, full card numbers or full Aadhaar numbers. Mask them: UIDAI's own "masked Aadhaar" shows only the last four digits.
• Do log security events: logins, failures, permission denials, admin actions.

def mask_aadhaar(number):
    digits = number.replace(" ", "")
    return "XXXX XXXX " + digits[-4:]

print(mask_aadhaar("1234 5678 9012"))

6. Path traversal

If a user can choose a file name, they may send "../../etc/passwd" to climb out of the intended folder. Fix: never use the raw name. Allow-list the characters, or map an ID to a file name on the server, and check the final path is still inside the allowed folder.

7. Dependencies and least privilege

• Use well-known libraries, pin versions, and update when security fixes come out (pip-audit, npm audit, Dependabot-style alerts).
• Run apps with the least privilege: a web app should not run as root or connect to the database as an admin user.

Common mistakes

• Validating only in the browser with JavaScript. Attackers skip the browser; validate on the server.
• Using a block-list like "remove the word script".
• Committing .env files or keys to GitHub.
• Logging full request bodies that include passwords or OTPs.