Application protection
Requests that change state use CSRF validation. Database access uses prepared statements. Public form submissions are rate limited, and integration callbacks require supported verification controls.
- CSRF validation
- Prepared database statements
- Rate limiting
- Idempotency controls
- HTTPS-only public callbacks