Treat URL parameters, bodies, uploads, imports, webhooks, and third-party responses as untrusted.

How to apply it

Validate shape, type, length, allowed values, and business rules. Use parameterized database operations, safe output encoding, appropriate CSP, HTTPS, and CSRF protections where relevant. CORS is not authentication. Validate upload size and content and store files privately.

Worked example

Map accepted query fields into a new MongoDB filter rather than passing a raw request query object directly.

Common mistakes to avoid

Trusting arbitrary database operators from input, unsafe HTML insertion, or assuming CORS prevents direct API calls.

Practice task

Implement this concept in the capstone. Add one positive test, one negative or failure-path test, and a short note explaining the trade-off you chose.