> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/technical-guidelines-code-standards-and-tech-stack/secure-engineering-standards/secure-by-design-for-developers.md).

# Secure by Design for Developers

## Purpose

Secure by design means engineers build security into the design, code, tests and deployment evidence from the start.

## Developer Responsibilities

Developers are responsible for:

* understanding security requirements
* protecting secrets
* validating input
* enforcing authorization
* avoiding insecure APIs
* writing security-relevant tests
* logging safely
* reviewing dependencies
* responding to vulnerability findings
* recording security exceptions

## Secure Coding Principles

* Deny by default.
* Least privilege.
* Validate at boundaries.
* Authorize every sensitive action.
* Keep secrets out of code.
* Use platform cryptography.
* Log events, not secrets.
* Fail safely.
* Keep dependencies current.
* Prefer supported frameworks over custom security code.

## Security Requirements in User Stories

Security acceptance criteria should be included in work items.

Example:

```
Given a user without Cases.Read
When they request GET /v1/cases/{id}
Then the API returns 403
And no case data is returned
And the access denial is logged with correlation id
```

## Secure Code Review Questions

* Is authorization enforced server-side?
* Are object-level permissions checked?
* Is input validated?
* Are secrets externalised?
* Are logs safe?
* Are errors safe for clients?
* Are dependencies approved?
* Are cryptographic operations platform-standard?
* Are security tests included?

## Required Evidence

* threat model or risk notes for sensitive features
* security acceptance criteria
* authorization tests
* dependency scan results
* code review record
* exception records if needed