Apply defense in depth: authenticate identities, authorize each action, validate input, encrypt traffic in transit and sensitive data at rest, manage secrets centrally, and audit privileged operations. Use least privilege, network segmentation, rate limits, secure defaults, dependency patching, and threat modeling. Protect against injection, SSRF, replay, credential theft, and data leakage. Security controls should be present in data flows and failure paths, not added only at the edge.