security

class CreateAuditLogs < ActiveRecord::Migration[6.1]
  def change
    create_table :audit_logs do |t|
      t.references :user, null: true, foreign_key: true
      t.string :action, null: false
      t.string :resource_type

class JwtService
  ACCESS_TOKEN_LIFETIME = 15.minutes
  REFRESH_TOKEN_LIFETIME = 7.days
  SECRET = Rails.application.credentials.jwt_secret

  def self.encode_access_token(user_id)

class ApplicationController < ActionController::Base
  before_action :set_turbo_cache_control

  class_attribute :turbo_no_cache, default: false

  def self.no_turbo_cache

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Rails.application.config.filter_parameters += [
  :password,
  :password_confirmation,
  :token,
  :authorization,
  :ssn,

require 'sinatra/base'
require_relative 'upload_store'

class UploadApp < Sinatra::Base
  MAX_BYTES = 50 * 1024 * 1024

import { NextRequestWithAuth } from 'next/server';
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';
import { verifySession } from './lib/verify-session';
import { isProtected, isAuthPage } from './lib/route-matchers';

from datetime import datetime, timedelta, timezone

from jose import jwt, JWTError
from jose.exceptions import ExpiredSignatureError

SECRET_KEY = "change-me-in-production"

// Configuration management with validation
const Joi = require('joi');

// Define schema for all environment variables
const envSchema = Joi.object({
  NODE_ENV: Joi.string()

class WebhookSignature
  class VerificationError < StandardError; end

  TOLERANCE = 300 # seconds

  def initialize(payload:, header:, secrets:)

# ECS Task Execution Role (pull images, push logs)
resource "aws_iam_role" "ecs_execution" {
  name = "${var.project_name}-ecs-execution"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"

// 1. DANGEROUS: Never use innerHTML with user input
const userInput = '<img src=x onerror="alert('XSS')">';

// WRONG - vulnerable to XSS
document.getElementById('output').innerHTML = userInput;