Back to the collection
PLAYBOOK / SECURITY
Application Security Baseline
A shared security floor for code that handles user data and credentials.
PlaybookCREWKIT COLLECTION
Application Security BaselineCrewKit
THE APPROACH
A clearer way forward.
Conventions for parameterized queries, managed secrets, deny-by-default authorization, audited dependencies, and verified TLS. A starting point to pair with scanners, threat models, and human review.
- Keep credentials out of committed source.
- Make authorization explicit at each endpoint.
- Use parameterized queries and verified outbound connections.
AT A GLANCE
Inside the approach.
An overview of this resource, not the full instructions.
- 01
Bind query values through the database driver.
- 02
Source secrets from a managed store.
- 03
Deny access by default and verify outbound TLS.
appsec-baseline