Security Aider Conventions

- Validate all inputs with strict allow-lists; reject anything that does not match
- Use parameterized queries or ORM for all database access; never string concatenation
- Hash passwords with argon2id (recommended) or bcrypt with cost factor >= 12
- Generate cryptographic tokens with crypto.randomBytes (Node) or secrets module (Python)
- Set secure cookie attributes: Secure, HttpOnly, SameSite=Strict
- Implement CSRF protection on all state-changing form endpoints
- Use timing-safe comparison for all secret and token equality checks
- Rotate signing secrets without downtime using key versioning