Security Basics

Before you start

You don't need to be a security researcher. You need to never trust client input, never put secrets in the bundle, escape output by default, and check authorization on every request. That covers the overwhelming majority of what actually goes wrong.