Secure Coding Practices

'User-supplied field is passed straight into a query' is a scenario cue for which Secure Coding Practice?

Input validation

'Comment text renders as script in other users' browsers' is a scenario cue for which Secure Coding Practice?

Output encoding

'Passwords stored in clear text' or 'no lockout after failures' is a scenario cue for which Secure Coding Practice?

Authentication and password management

'Session ID in the URL' or 'session survives logout' is a scenario cue for which Secure Coding Practice?

Session management

'User changes an ID in the URL and sees another user’s account data' is a scenario cue for which Secure Coding Practice?

Access control

'Team invented its own cipher' is a scenario cue for which Secure Coding Practice?

Cryptographic practices

'Stack trace displayed to the user' is a scenario cue for which Secure Coding Practice?

Error handling and logging

'Hard-coded credentials in source' is a scenario cue for which Secure Coding Practice?

Data protection

'Data sent over plain HTTP' is a scenario cue for which Secure Coding Practice?

Communication security

'Default admin account left enabled' is a scenario cue for which Secure Coding Practice?

System configuration

'App connects to the DB as an administrator' is a scenario cue for which Secure Coding Practice?

Database security

'Upload accepts any file type' is a scenario cue for which Secure Coding Practice?

File management

'Unchecked copy into a fixed-size buffer' is a scenario cue for which Secure Coding Practice?

Memory management

Check all untrusted input for type, length, range, and format, using allow-lists on the server: which Secure Coding Practice?

Input validation

Encode data for its destination context (HTML, URL, SQL) before it leaves the app: which Secure Coding Practice?

Output encoding

Verify identity with strong, hashed, salted credentials and lockout rules: which Secure Coding Practice?

Authentication and password management

Generate random session IDs, expire and invalidate on logout, protect cookies: which Secure Coding Practice?

Session management

Enforce least privilege and deny by default on every request, server side: which Secure Coding Practice?

Access control

Use vetted algorithms and protected key storage, never custom crypto: which Secure Coding Practice?

Cryptographic practices

Show generic errors to users, log detail privately, protect log integrity: which Secure Coding Practice?

Error handling and logging

Encrypt sensitive data at rest, minimize what is stored, no secrets in code: which Secure Coding Practice?

Data protection

Use TLS for data in transit and validate certificates: which Secure Coding Practice?

Communication security

Harden servers, patch, remove defaults, disable unused features: which Secure Coding Practice?

System configuration

Parameterized queries, least-privilege DB accounts, no direct user queries: which Secure Coding Practice?

Database security

Validate file names and types, restrict upload and path access: which Secure Coding Practice?

File management

Bounds checking, safe functions, free memory correctly: which Secure Coding Practice?

Memory management

Which Secure Coding Practice prevents these flaws: SQL injection, buffer overflow, command injection?

Input validation

Which Secure Coding Practice prevents these flaws: Cross-site scripting (XSS)?

Output encoding

Which Secure Coding Practice prevents these flaws: Credential stuffing, weak or stored-in-plaintext passwords?

Authentication and password management

Which Secure Coding Practice prevents these flaws: Session hijacking, fixation?

Session management

Which Secure Coding Practice prevents these flaws: Privilege escalation, insecure direct object references?

Access control

Which Secure Coding Practice prevents these flaws: Data exposure from weak or home-grown encryption?

Cryptographic practices

Which Secure Coding Practice prevents these flaws: Information leakage, missing audit trail?

Error handling and logging

Which Secure Coding Practice prevents these flaws: Exposure of PII and card data?

Data protection

Which Secure Coding Practice prevents these flaws: Eavesdropping, man-in-the-middle?

Communication security

Which Secure Coding Practice prevents these flaws: Exploits of default or unpatched settings?

System configuration

Which Secure Coding Practice prevents these flaws: SQL injection, over-privileged DB access?

Database security

Which Secure Coding Practice prevents these flaws: Path traversal, malicious uploads?

File management

Which Secure Coding Practice prevents these flaws: Buffer overflow, memory leaks?

Memory management