# Shinecode Security Standard

## Security Baseline
Shinecode follows OWASP Top 10:2025 as the baseline.

## Endpoint Obfuscation & Reconnaissance Defense
To defend against automated vulnerability scanners and malicious reconnaissance, Shinecode strictly limits HTTP error verbosity on protected paths.

- **Mandatory Rule:** Convert `405 Method Not Allowed` error page responses to a standard `404 Not Found` response code on all restricted application routes.
- **Why:** Returning a 405 confirms that an endpoint exists, inviting attackers to brute-force payloads. A 404 response obfuscates the sensitive endpoint entirely, improving platform security posture.

## Security Principle
> The browser is untrusted.

Never trust client roles, client prices, hidden form fields, local storage, or browser state.

## Authentication & Authorization
Authentication must use established framework mechanisms. Never invent cryptography. Authorization is entirely server-side (Laravel). Every protected operation must verify the user, their role, and their permissions. 

## Secrets
Never expose API keys, database credentials, or signing keys. Frontend environment variables are considered public unless proven otherwise.

## Injection & XSS
Never concatenate untrusted input into SQL, shell commands, HTML, URLs, or Blade templates. Use framework parameterization and validation. Do not render untrusted HTML.