|
| 1 | +# 🔐 ACAP Developer Security Best Practices Checklist |
| 2 | + |
| 3 | +> This checklist, reflecting the needs of the [Security](/security) section and the [ACAP Professional Mindset on Security](https://github.com/acaptutorials/acaptutorials/blob/main/README.md#-acap-professional-mindset-on-security), enumerates the desirable traits and mindsets of programmers, especially for **code maintainers** or **main/primary ACAP lead developers** handling ACAP development. |
| 4 | +> |
| 5 | +> ✅ Use this checklist as a guideline along with the [Security](#security) expectations during planning, code reviews, or when designing features that handle user input, authentication, or database operations. |
| 6 | +
|
| 7 | +### 1. Mindset and Responsibility |
| 8 | +- [ ] I prioritize **user safety and data protection** over rapid feature delivery. |
| 9 | +- [ ] I integrate **security considerations in every development phase**—from design to deployment. |
| 10 | +- [ ] I recognize that **security is a shared team responsibility**, not a post-incident task. |
| 11 | + |
| 12 | +### 2. Firestore & Backend Practices |
| 13 | +- [ ] I **avoid writing to Firestore directly from the front-end** when the data is sensitive or requires validation. |
| 14 | +- [ ] I implement **strong Firestore security rules** that match the expected schema and use strict access controls. |
| 15 | +- [ ] I **validate all input server-side**, even if it’s also validated on the front-end. |
| 16 | + |
| 17 | +### 3. Input Handling and Content Security |
| 18 | +- [ ] I sanitize **WYSIWYG or HTML-formatted input** to prevent XSS or unsafe content injection. |
| 19 | +- [ ] I use **established libraries and sanitization methods** instead of building ad-hoc solutions for HTML or user input. |
| 20 | +- [ ] I escape user-generated content correctly in all **PDFs, emails, and rendered UI components**. |
| 21 | + |
| 22 | +### 4. Data Structure Integrity |
| 23 | +- [ ] I enforce **tight schema validation** to prevent Firestore document pollution (uncontrolled key-value growth). |
| 24 | +- [ ] I use **Firebase Cloud Functions or middle-layer APIs** to validate and shape incoming data before writing to the database. |
| 25 | +- [ ] I regularly monitor for **unexpected document structures or recursive collections**. |
| 26 | + |
| 27 | +### 5. Security Reports and Technical Debt |
| 28 | +- [ ] I take **security concerns seriously**, especially those that are **clearly reproducible** or reported by team members. |
| 29 | +- [ ] I **do not delay security fixes** unless justified with clear documentation and risk mitigation steps. |
| 30 | +- [ ] I log and track known vulnerabilities as **actionable backlog items**, not as "someday" issues. |
| 31 | + |
| 32 | +### 6. Team Collaboration and Growth |
| 33 | +- [ ] I am **open to feedback** and security advice from peers, even if it challenges my current approach. |
| 34 | +- [ ] I **communicate blockers** early if I need help on a security implementation. |
| 35 | +- [ ] I actively **share security learnings** with the rest of the team (e.g., via code reviews or internal notes). |
| 36 | + |
0 commit comments