# Security, Privacy, and Accessibility Baseline

## Security baseline

- Store secrets only in environment configuration or an approved secret store.
- Commit an `.env.example`, never a live `.env`.
- Validate and normalize untrusted input server-side.
- Encode output according to its destination context.
- Use parameterized database operations.
- Enforce authorization on the server, not only by hiding interface controls.
- Apply least privilege to service accounts, API keys, users, and database roles.
- Rate-limit publicly reachable high-risk endpoints.
- Protect state-changing browser requests against applicable cross-site request attacks.
- Configure secure cookies when cookies carry identity or sensitive state.
- Avoid logging passwords, tokens, payment information, or unnecessary personal data.
- Return safe error messages to users and detailed errors only to protected logs.
- Restrict file uploads by type, size, naming, storage location, and execution behavior.
- Maintain dependency awareness and remove unused packages.
- Use TLS for production traffic.
- Document backup, restore, and credential-rotation procedures.

## Privacy baseline

- Collect only the data required for the stated purpose.
- Explain how submitted information will be used.
- Obtain consent where legally or contractually required.
- Define retention and deletion behavior for personal information.
- Restrict staff and system access to collected data.
- Identify third-party processors and integrations.
- Avoid placing sensitive information in URLs, analytics payloads, or browser storage.

## Accessibility baseline

- Use semantic landmarks, headings, lists, buttons, links, labels, and tables.
- Ensure every interactive element is reachable and operable by keyboard.
- Provide visible focus indicators.
- Maintain sufficient text and interface contrast.
- Pair inputs with programmatic labels and useful validation messages.
- Announce important dynamic updates where necessary.
- Provide meaningful text alternatives for informative images.
- Do not rely on color alone to communicate meaning.
- Respect reduced-motion preferences.
- Maintain readable zoom and reflow behavior.
- Use ARIA only when native HTML cannot express the required behavior.

## Critical review questions

1. Can a user perform the primary task without a mouse?
2. Can a user understand errors and recover from them?
3. Can one user access another user's records or actions?
4. Is any secret visible in source code, browser requests, logs, or repository history?
5. Is collected data necessary and handled as described?
6. Does the site remain usable at narrow widths and high zoom?