security

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Rails.application.config.filter_parameters += [
  :password,
  :password_confirmation,
  :token,
  :authorization,
  :ssn,

require 'sinatra/base'
require_relative 'upload_store'

class UploadApp < Sinatra::Base
  MAX_BYTES = 50 * 1024 * 1024

import { NextRequestWithAuth } from 'next/server';
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';
import { verifySession } from './lib/verify-session';
import { isProtected, isAuthPage } from './lib/route-matchers';

from datetime import datetime, timedelta, timezone

from jose import jwt, JWTError
from jose.exceptions import ExpiredSignatureError

SECRET_KEY = "change-me-in-production"

// Configuration management with validation
const Joi = require('joi');

// Define schema for all environment variables
const envSchema = Joi.object({
  NODE_ENV: Joi.string()

class WebhookSignature
  class VerificationError < StandardError; end

  TOLERANCE = 300 # seconds

  def initialize(payload:, header:, secrets:)

# ECS Task Execution Role (pull images, push logs)
resource "aws_iam_role" "ecs_execution" {
  name = "${var.project_name}-ecs-execution"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"

use pulldown_cmark::{html, Options, Parser};
use std::collections::HashSet;

pub struct SafeHtml(String);

impl SafeHtml {

use serde::{Deserialize, Serialize};
use std::time::{SystemTime, UNIX_EPOCH};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Session {
    pub user_id: u64,

// 1. DANGEROUS: Never use innerHTML with user input
const userInput = '<img src=x onerror="alert('XSS')">';

// WRONG - vulnerable to XSS
document.getElementById('output').innerHTML = userInput;

import jwt, { JwtPayload, SignOptions } from 'jsonwebtoken';

const SECRET = process.env.JWT_SECRET as string;
const ISSUER = 'auth.example.com';
const AUDIENCE = 'api.example.com';