Security Guidelines

# Security Rules

- Never hardcode secrets, API keys, or credentials
- Use environment variables for all sensitive config
- Sanitize all user inputs before database queries
- Use parameterized queries, never string concatenation for SQL
- Validate file paths to prevent directory traversal
- Set appropriate CORS headers
- Use HTTPS for all external API calls
- Never log sensitive data (passwords, tokens, PII)
- Follow principle of least privilege for file/API access