Transport & encryption
HTTPS is baseline; for identity and sensitive flows, layer TLS, certificate pinning, or mTLS as risk dictates.
Access control
- Least privilege: grant only what is required for the job.
- Auditability: critical actions should be traceable with alerts where appropriate.
Disclosure
If you discover a vulnerability, report it through the official security channel; avoid posting exploitable details publicly.