The summary.
FOR SENDING MAIL
Send from your own domain through an authenticated account, never as the visitor's address.
Set reply-to instead, and ensure the sending route is covered by your authentication records.
FOR SPREADSHEET FILES
Locate columns by header name, not position. Workbooks are edited by people and structure changes without notice.
Dates arrive as numbers, and a saved file may give you formulas rather than results.
FOR IMAGES
Automating resize and compression at upload permanently solves the largest cause of slow pages.
Strip metadata before publishing anything from a phone — it frequently carries location data.
Validate that an upload is genuinely an image by content, not extension.
FOR PATTERN MATCHING
Use string methods first. Never parse markup or CSV with patterns — use a proper parser.
FOR ARCHIVES FROM OUTSIDE
Validate every entry's destination before extracting. An archive can contain paths that escape the destination, and a small archive can expand enormously.
WHEN RUNNING EXTERNAL COMMANDS
Never build the command by joining strings containing outside values. Pass arguments as a list, and always set a timeout.
FOR FETCHING FROM WEBSITES
Prefer an official API. Respect stated restrictions and rate — rapid automated requests look like an attack.
FOR INTEGRATIONS
Any exchange that can run twice must handle it. Record what has been processed.
