语言与基础运行时
elixir-otp-security
更新于 2026-09-30
Elixir · 安全规则
Security rules for Elixir: boundary validation, server-side authorisation and zero secret leakage.
- 技术栈
- Elixir
- 主题
- 安全
- 条目
- 9 条
- 版本
- v0.2.0
✓ 应当这么做
- ✓ Validate and normalise every input at the boundary it enters the system
- ✓ Authorise on the server against the authenticated principal, never on client claims
- ✓ Keep secrets out of repositories, logs and error messages
✕ 常见反模式
- ✕ Trusting headers or parameters that a client can set freely
- ✕ Disabling TLS verification or CSRF protection to unblock a test
- ✕ Wide-scope tokens with no expiry
◎ 交付前验证
- ◎ Compiler/interpreter warnings treated as errors for new code
- ◎ Test suite passes on the minimum supported language version
- ◎ Public API diff reviewed for accidental surface growth
同分类条目
32 篇语言与基础运行时
Go 工程规则
Idiomatic Go 1.22+ error handling — wrapped errors, errors.Is/As and context propagation
语言与基础运行时
TypeScript 工程规则
TypeScript strict-mode delivery rules: exhaustive handling and narrowed unknown types
语言与基础运行时
Rust 工程规则
Rust ownership-aware rules: Result/Option modelling and clippy-clean output
语言与基础运行时
Python 工程规则
Python typing discipline with builtin generics and boundary validation
语言与基础运行时
Java 工程规则
Java record-first service rules: immutable DTOs and explicit dependency wiring
语言与基础运行时
Kotlin 工程规则
Kotlin coroutine rules: structured concurrency and cancellation-safe scopes