security

from datetime import datetime, timedelta, timezone

from jose import jwt, JWTError
from jose.exceptions import ExpiredSignatureError

SECRET_KEY = "change-me-in-production"

// Configuration management with validation
const Joi = require('joi');

// Define schema for all environment variables
const envSchema = Joi.object({
  NODE_ENV: Joi.string()

class WebhookSignature
  class VerificationError < StandardError; end

  TOLERANCE = 300 # seconds

  def initialize(payload:, header:, secrets:)

# ECS Task Execution Role (pull images, push logs)
resource "aws_iam_role" "ecs_execution" {
  name = "${var.project_name}-ecs-execution"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"

use pulldown_cmark::{html, Options, Parser};
use std::collections::HashSet;

pub struct SafeHtml(String);

impl SafeHtml {

use serde::{Deserialize, Serialize};
use std::time::{SystemTime, UNIX_EPOCH};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Session {
    pub user_id: u64,

// 1. DANGEROUS: Never use innerHTML with user input
const userInput = '<img src=x onerror="alert('XSS')">';

// WRONG - vulnerable to XSS
document.getElementById('output').innerHTML = userInput;

import jwt, { JwtPayload, SignOptions } from 'jsonwebtoken';

const SECRET = process.env.JWT_SECRET as string;
const ISSUER = 'auth.example.com';
const AUDIENCE = 'api.example.com';

# === Vault Agent Injector: Auto-inject secrets into pods ===
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-server
  namespace: production

package middleware

import (
  "net/http"
)

use axum::{
    extract::{FromRequestParts, State},
    http::{request::Parts, StatusCode},
    response::{IntoResponse, Response},
    Json,
};

class PaymentService
  def initialize
    Stripe.api_key = Rails.application.credentials.stripe[:secret_key]
  end

  def create_payment_intent(amount:, currency: 'usd')