Security Best Practices

Security in CodeSky has two surfaces: the platform itself, and the apps it generates. The platform is hardened for you; for your apps, the generator applies safe defaults — and you can always ask for more.

The platform

• Provider API keys live in server-side configuration, never in the client bundle.
• JWT tokens are scoped per user, with refresh-token rotation.
• Your projects live in a per-user, per-project directory with isolation — one user cannot read another's files.
• The preview proxy only forwards to ports owned by the requesting user.

Your generated apps — safe defaults

• Helmet (Node) or an equivalent strict security-header / CSP middleware.
• Rate limiting on authentication endpoints.
• Parameterized queries — no string-concatenated SQL.
• .env templates for secrets, git-ignored so they're never committed.

Asking for more

1. Add protections by prompt — "add rate limiting to the public API", "require HTTPS and set secure cookies".
2. Validate inputs — "validate and sanitize all form inputs".
3. Before shipping, run a review — "review this app for common web vulnerabilities and fix what you find."

A quick pre-launch checklist

• Secrets in .env, not in code.
• Auth required on everything that isn't meant to be public.
• Inputs validated; errors don't leak stack traces to users.
• Rate limiting on login and any expensive endpoint.

Common mistakes to avoid

• Committing a key "just for now". Treat anything in git as public; rotate it if it slips in.
• Trusting the frontend. Enforce authorization on the API, not just by hiding UI.
• Leaking errors. Show users a friendly message; log the details server-side.

FAQ