security-principles

exceptionless's avatarfrom exceptionless

Security best practices for the Exceptionless codebase. Secrets management, input validation,secure defaults, and avoiding common vulnerabilities.Keywords: security, secrets, encryption, PII, logging, input validation, secure defaults,environment variables, OWASP, cryptography

⭐2.4kstars🔀513forks📁View on GitHub🕐Updated Jan 10, 2026
[Security Operations]

When & Why to Use This Skill

This Claude skill provides a comprehensive set of security best practices and principles designed for the Exceptionless codebase. It covers critical areas such as secrets management via Kubernetes, input validation, and the prevention of sensitive data exposure in logs, helping developers align with OWASP standards and modern cryptographic requirements.

Use Cases

  • Secrets Management: Guidance on injecting credentials via environment variables and Kubernetes to avoid committing secrets to repositories.
  • Input Validation & Sanitization: Establishing 'fail-fast' validation logic and sanitizing external data to prevent injection and XSS vulnerabilities.
  • Secure Logging Practices: Implementing rules to ensure PII and sensitive tokens are excluded from structured logs.
  • Cryptographic Standards: Transitioning from broken algorithms like MD5 to secure alternatives like SHA256 and SHA512.
  • Secure Serialization: Guidance on avoiding vulnerable components like BinaryFormatter in favor of safe alternatives like System.Text.Json.
nameSecurity Principles
description|
Keywordssecurity, secrets, encryption, PII, logging, input validation, secure defaults,

Security Principles

Secrets Management

Secrets are injected via Kubernetes ConfigMaps and environment variables — never commit secrets to the repository.

  • Configuration files — Use appsettings.yml for non-secret config
  • Environment variables — Secrets injected at runtime via EX_* prefix
  • Kubernetes — ConfigMaps mount configuration, Secrets mount credentials
// AppOptions binds to configuration (including env vars)
public class AppOptions
{
    public string? StripeApiKey { get; set; }
    public AuthOptions Auth { get; set; } = new();
}

Validate All Inputs

  • Check bounds and formats before processing
  • Use ArgumentNullException.ThrowIfNull() and similar guards
  • Validate early, fail fast

Sanitize External Data

  • Never trust data from queues, caches, user input, or external sources
  • Validate against expected schema
  • Sanitize HTML/script content before storage or display

No Sensitive Data in Logs

  • Never log passwords, tokens, API keys, or PII
  • Log identifiers and prefixes, not full values
  • Use structured logging with safe placeholders

Use Secure Defaults

  • Default to encrypted connections (SSL/TLS enabled)
  • Default to restrictive permissions
  • Require explicit opt-out for security features

Avoid Deprecated Cryptographic Algorithms

Use modern cryptographic algorithms:

  • ❌ MD5, SHA1 — Cryptographically broken
  • ✅ SHA256, SHA512 — Current standards

Avoid Insecure Serialization

  • ❌ BinaryFormatter — Insecure deserialization vulnerability
  • ✅ System.Text.Json, Newtonsoft.Json — Safe serialization

Input Bounds Checking

  • Enforce minimum/maximum values on pagination parameters
  • Limit batch sizes to prevent resource exhaustion
  • Validate string lengths before storage

OWASP Reference

Review OWASP Top 10 regularly:

  1. Broken Access Control
  2. Cryptographic Failures
  3. Injection
  4. Insecure Design
  5. Security Misconfiguration
  6. Vulnerable and Outdated Components
  7. Identification and Authentication Failures
  8. Software and Data Integrity Failures
  9. Security Logging and Monitoring Failures
  10. Server-Side Request Forgery