# Security Guidelines

- Never hardcode secrets (API keys, passwords, etc.)
- Always validate user input
- Use environment variables properly
- Never modify confidential files like .env
- Consider threats such as XSS, CSRF, and IDOR