Group it by what each control actually buys you.
Getting in the door. API key authentication on anything non-public, and never an empty default key. CORS configured to real origins, not a wildcard. Webhook endpoints that verify the sender's signature rather than trusting the payload. For anything touching a database: a read-only role, a SQL validation stack, and an explicit write-table allowlist for admin paths.
Surviving load. Rate limiting keyed on the real client IP - getting that wrong throttles your whole user base as one client. Then concurrency caps, because a rate limit counts requests per minute while an attacker sends a burst all at once. And the one people miss entirely: endpoints where a cheap request triggers expensive work.
Not handing anything away. Sanitized error messages (raw exceptions leak file paths, table names and versions). No Swagger or OpenAPI schema on an internal backend. Escaped user input in any HTML your backend generates. Centralized logging with a PII retention policy, and cleanup of old report and temp files.
Not becoming the attacker's tool. SSRF protection on anything that fetches a URL the user supplied, file-upload validation, and verified TLS on outbound calls. Plus monitoring, so you can see any of this happening.
Full item-by-item checklist with code: https://www.tigzig.com/security/backend.
← All Agents FAQ