Most breaches aren't exotic. They're default passwords, missing headers, unvalidated input and forgotten dependencies. A day of disciplined defaults eliminates the majority of real-world risk.
Trust nothing that crosses the boundary
Validate and type-check every input on the server, no matter what the UI enforces. Use parameterised queries everywhere - string-built SQL is still the top cause of catastrophic breaches decades after we learned better. Escape output by default; template engines do this for you unless you actively opt out.
Ship the headers
- Content-Security-Policy - kills most XSS classes outright
- Strict-Transport-Security - HTTPS, always, everywhere
- X-Content-Type-Options: nosniff and a sane Referrer-Policy
These cost one config file and quietly block entire attack categories.
Secrets and sessions, done boringly
Secrets live in environment config, never in the repo. Sessions get HttpOnly, Secure, SameSite cookies. Passwords get a modern hash (argon2/bcrypt) and rate-limited login attempts. Admin routes get a second factor. None of this is novel - that's the point.
Patch on a schedule, not on a scare
Enable dependency alerts and act on them weekly. Most exploited vulnerabilities had patches available for months. A 15-minute weekly update habit outperforms any incident response plan you'll hopefully never need.