Illustrious Consulting · Coding Practices Manual · Part 2 of 2

Back-end practices, made breachable.

The twelve security practices that live behind the page — keys, rows, queries, and the attacker sims that prove why each one is non-negotiable.

12 interactive cards · attacker simulations included

Back-end security practices

Every demo shows the breach first, then the governed fix.

Security #1

Hide API keys

An API key is a password that lets your app talk to another service (maps, payments, AI). Keeping it hidden means storing it in a secret place on the server — never in the code a visitor can see, and never in files that get shared or published.

If a key leaks, anyone can use your accounts and run up charges in your name. Leaked keys are one of the most common causes of surprise bills and account takeovers.

Tell your AI agentHide all API keys: move every key into server-side environment variables or secret storage, remove them from any client-side code or public files, and rotate any key that may already be exposed.
ClientServerAttacker

Browser · what visitors receive

Server · environment

Security #2

Purge Git secrets

Git saves every version of your project's history — so even if you delete a password from a file today, it still exists in yesterday's version. Purging means permanently removing old secrets from that entire history, then making sure it can't happen again.

Deleting a secret in a new commit doesn't delete it from history. Anyone who downloads the project later can walk back in time and pull the old password right out.

Tell your AI agentScrub all secrets from Git history with a history-rewriting tool, then add automatic secret-scanning so new secrets are blocked before they're ever committed.

Attacker checks out commit 4 · config.js

Security #3

Use public DB key

Modern databases (like Supabase or Firebase) give two kinds of keys: a 'public' key that's safe for use in browsers, and a secret 'service' key that has full power. Using the public key means the browser only ever holds the harmless one.

If the powerful key ends up in the browser, anyone can read or erase your entire database. The public key is designed to be visible — it's only safe when paired with proper access rules.

Tell your AI agentAudit all database keys: only the designated public/anon key may appear in frontend code; the service/admin key stays server-side only. Replace any admin key found in frontend code.
ClientServerAttackerDB

Browser bundle

Server

Database

Security #4

Enable row-level security

Row-level security (RLS) is a rule the database itself enforces: each user can only see and change their own rows. It's like an apartment building where the front door is shared, but each unit has its own lock.

Without it, one user can ask the database for someone else's records just by changing an ID number in the web address — and the database, with no rule saying otherwise, hands it over.

Tell your AI agentEnable row-level security on every table: default-deny all access, then allow each user to read and write only rows tied to their own account ID. Report any table left wide open.
DB
apt 101Maya🔒 unit lock
apt 102Ravi🔒 unit lock
apt 103Sam🔒 unit lock
Security #5

Encrypt sensitive data

Encryption scrambles data so it looks like meaningless noise to anyone who doesn't have the key. Do it for data sitting in storage ('at rest') and data traveling across the internet ('in transit').

If a laptop, backup, or database dump is stolen, encrypted data is unreadable garbage. Unencrypted data is an open book — this is exactly how large data breaches make the news.

Tell your AI agentEncrypt sensitive data at rest and in transit: use HTTPS everywhere, encrypt stored personal data with modern AES encryption, and never store unencrypted sensitive info in logs, backups, or temporary files.
DataAttacker

Laptop

HTTPS wire

Encrypted backup drive

Thief opens the copy

Security #6

Enforce server-side auth

Authentication and permissions must be checked by the server on every single request. Anything the browser checks can be skipped by the user, because the user controls the browser.

Hiding an admin button in the app does nothing if the server still answers when someone types the admin address directly. It's like hiding the key under the mat — the door itself is still unlocked.

Tell your AI agentMove all authentication and permission checks server-side: the server must verify identity and role on every request and every API endpoint, never trusting anything the browser sends or hides.
ClientServerAttacker

Customer's browser

[ Admin panel ]
/admin/discounts — link not shown anywhere

Server

Security #7

Lock record access

Locking record access means the server checks 'does this record belong to the person asking?' every time someone opens, edits, or deletes one. It's the per-record cousin of row-level security.

A very common hack: change the number in a link like /invoice/1043 to /invoice/1044 and view a stranger's invoice. If the server doesn't check ownership, the numbering itself becomes the only 'security'.

Tell your AI agentAdd ownership checks on every record endpoint: the server must verify the logged-in user owns (or is authorized for) each record before reading, updating, or deleting it. No ID-based access without a check.
ServerAttacker
https://app.com/invoice/1043
Invoice #1043Yours — $89.00
Invoice #1044Stranger — $412.75
Security #8

Block field tampering

Users can change anything sent from the browser — including hidden fields and prices. Block tampering by having the server decide everything important: prices, roles, quantities, discounts.

An app that trusts the browser's prices can be told 'this item costs $1' by anyone editing the page in the browser's tools. The server is the only referee the cheater can't talk to.

Tell your AI agentNever trust client-submitted prices, roles, IDs, or permissions: the server must recompute all critical values from its own database and ignore any client-provided value for those fields.
ClientServerAttacker
Headphones $149.00price from the catalog
Security #9

Secure session cookie

A session cookie is the little ID card your browser shows after logging in. Setting it 'secure' means: only sent over encrypted connections (Secure), invisible to web-page scripts (HttpOnly), and blocked from other websites (SameSite).

An unprotected cookie can be stolen by a malicious page, letting the thief impersonate you without ever knowing your password — the login itself stays useless without the card.

Tell your AI agentSet all session cookies with Secure, HttpOnly, and SameSite=Lax (or Strict) flags, and regenerate the session ID at login to prevent session-fixation attacks.
ClientAttacker

Cookie jar

Hidden script on page

document.cookie → ?
Security #10

Hash passwords

Hashing turns a password into a fixed-length fingerprint using a one-way function. You can check 'does this fingerprint match?' but you can never turn the fingerprint back into the password. Add a 'salt' (random extra data) so identical passwords get different fingerprints.

If the password table is stolen, hashed passwords stay useless to the thief. Plain-text or weakly-hashed passwords are an instant catastrophe — and users reuse passwords everywhere.

Tell your AI agentStore passwords only as salted hashes using a modern slow algorithm (bcrypt, scrypt, or Argon2) — never plain text, never MD5 or SHA-1 alone. Add a migration plan for any existing weak hashes.
DBAttacker

users table

Thief's result

Security #13

Parameterize queries

A parameterized query is how a database is asked questions safely: the question and the data travel separately, so user-supplied text can never be mistaken for a command.

Without it, a user typing ' OR 1=1 -- into a search box can make the database hand over every record — the classic SQL injection attack, still one of the most exploited vulnerabilities in the world.

Tell your AI agentReplace all string-concatenated database queries with parameterized queries or an ORM everywhere; run an audit to find and fix any query built by joining user input into a SQL string.
attackerappdb
attacker search / login box
SQL the server builds →
db users table
press Enter or ▶ — watch the same text hit two different servers
Security #20

Scan dependencies

Modern apps are built mostly from other people's packages (libraries). Scanning means automatically checking those packages against known-vulnerability lists (CVEs) and keeping them updated.

Your code can be perfect and still get hacked through an outdated library you didn't even know you had. Attacks on dependencies outnumber attacks on hand-written code.

Tell your AI agentAdd automated dependency scanning (npm audit / Dependabot / equivalent) to the project, review the report, update or replace all packages with known CVEs, and re-check monthly.
attackerscanner
scanner your app's dependency tree
express4.17.1✓ clean
lodash4.17.15✓ clean
log-lib2.3.0
your code can be perfect — the hole lives three packages deep
Part of the Illustrious Visual Reference · Interactive companion to the Coding Practices Manual · 2026