Secure Coding Standard: [Organisation or product]

Secure coding standard for application developers: scope and languages, mandatory rules by area (input validation, output encoding, authentication, session management, access control, cryptography, secrets, error handling and logging, dependency use, file handling, API security) with do and don't code examples, required tooling (SAST, DAST, secret scanning) and an exceptions process. The areas reflect widely used OWASP concepts (for example the OWASP Top 10 and ASVS topics); the rules and examples are original. Replace every [bracketed] value and adapt examples to your stack.

1. Purpose and scope

This standard defines the minimum secure coding rules for software written or maintained by [Organisation]. It applies to production code, infrastructure as code and build scripts. Prototypes that never handle real data are exempt until they are promoted.

Rule keywords: MUST is mandatory and enforced in review; SHOULD is expected unless a documented reason applies.

2. Input validation

Do:

import { z } from "zod";
const CreateOrder = z.object({
  sku: z.string().regex(/^[A-Z0-9-]{3,32}$/),
  quantity: z.number().int().min(1).max(999),
}).strict(); // rejects unknown fields
const input = CreateOrder.parse(req.body);

Don't:

// Trusts every field the client sends, including "price" and "isAdmin"
const order = await db.order.create({ data: req.body });

3. Output encoding and injection prevention

Do:

cur.execute("SELECT id, total FROM orders WHERE customer_id = %s", (customer_id,))
subprocess.run(["convert", src_path, dst_path], check=True)  # no shell

Don't:

cur.execute(f"SELECT * FROM orders WHERE customer_id = '{customer_id}'")
os.system("convert " + filename + " out.png")

4. Authentication

Do:

from argon2 import PasswordHasher
ph = PasswordHasher()
stored = ph.hash(password)
ph.verify(stored, attempt)

Don't:

stored = hashlib.md5(password.encode()).hexdigest()

5. Session management

Do:

res.cookie("__Host-sid", sessionId, {
  secure: true, httpOnly: true, sameSite: "lax", path: "/", maxAge: 30 * 60 * 1000,
});

Don't:

localStorage.setItem("refreshToken", token); // readable by any injected script

6. Access control

Do:

order, err := store.GetOrder(ctx, orderID)
if err != nil || order.TenantID != caller.TenantID {
    http.NotFound(w, r) // do not reveal existence
    return
}

Don't:

order, _ := store.GetOrder(ctx, r.URL.Query().Get("id")) // any logged-in user, any order

7. Cryptography

Do:

import { randomBytes } from "node:crypto";
const resetToken = randomBytes(32).toString("base64url");

Don't:

const resetToken = Math.random().toString(36).slice(2); // predictable

8. Secrets

Do:

db_password = secrets_client.get_secret_value(SecretId="prod/payments/db")["SecretString"]

Don't:

DB_PASSWORD = "Summer2026!"  # in source, in history, in every clone

9. Error handling and logging

Do:

logger.warn({ event: "authz_denied", userId, resource: "order", orderId, requestId });
res.status(404).json({ type: "about:blank", title: "Not found", requestId });

Don't:

logger.info("Login for " + req.body.email + " with password " + req.body.password);
res.status(500).send(err.stack);

10. Dependency use

Do:

- uses: actions/checkout@<full-40-character-commit-sha>  # v4.2.2
- run: npm ci

Don't:

- uses: some-org/deploy-action@main
- run: npm install

11. File handling

Do:

safe_name = f"{uuid4()}.pdf"
dest = (UPLOAD_ROOT / safe_name).resolve()
assert dest.is_relative_to(UPLOAD_ROOT)

Don't:

open(os.path.join("/srv/uploads", request.args["name"]), "wb").write(data)  # ../../etc

12. API security

Do:

class OrderOut(BaseModel):
    id: str
    status: str
    total: Decimal  # no internal cost, no customer email

@app.get("/orders/{order_id}", response_model=OrderOut)

Don't:

@app.get("/orders/{order_id}")
def get_order(order_id: str):
    return db.query(Order).get(order_id).__dict__  # every column, every tenant

13. Tooling and verification

Coverage target: [100%] of production repositories run SAST, secret scanning and SCA by YYYY-MM-DD.

14. Exceptions process

A team that cannot meet a MUST rule requests an exception before merge:

1. Open a ticket in [SEC project] with the rule ID, the code location, the reason and the compensating controls.
2. The application security team assesses risk within [5 business days].
3. Approval authority: Medium risk by [@appsec-lead]; High risk by [@ciso].
4. Approved exceptions are recorded in the register below, linked from a code comment at the location, and expire after at most [6 months].

15. Training and review

New developers complete [secure coding training] within 30 days of joining and yearly afterwards. Compliance is measured quarterly by [open SAST findings per repository, exceptions past expiry, and the share of repositories with all required tools]. The standard owner reviews this document yearly and after any incident caused by a coding weakness.

Standard and licence note

Based on common industry practice for secure coding and on widely used OWASP concepts, such as the risk areas of the OWASP Top 10 and the topic areas of the OWASP Application Security Verification Standard. No OWASP text is reproduced; the rules, IDs and code examples are original and written for this collection. Consult OWASP resources (owasp.org) for detailed guidance. Template licence: MIT.