The summary.
EVERYTHING IN THE CLIENT IS UNDER THE USER'S CONTROL
Prices, permissions, validation and secrets all belong on the server. Never trust identifiers, totals or hidden fields from a request.
VALIDATE EVERYTHING ARRIVING FROM OUTSIDE, INCLUDING OTHER SERVICES
Use a schema in one place rather than checks scattered through handlers, and enforce limits on request size, uploads and array lengths.
Absent limits are how services are overwhelmed.
DISTINGUISH EXPECTED FROM UNEXPECTED FAILURES
Expected: a specific status and clear message. Unexpected: a generic message and an identifier the user can quote.
Never return stack traces, paths or database errors.
TIE LOG ENTRIES TO A REQUEST IDENTIFIER
So one request can be traced across everything it produced. And alert on error rate, not only on unavailability.
VALIDATE CONFIGURATION AT STARTUP AND FAIL CLEARLY
Failing at startup beats failing obscurely under load. A committed secret must be rotated — it remains in history.
KNOW YOUR STACK'S CONCURRENCY MODEL AND WHAT IT FORBIDS
Most severe performance faults are a violation of it. Move anything slow out of the request entirely.
