Trust No Input You Did Not Make

Every field
is a door.

Every door
is a question
you are asking
a stranger.

And the stranger
does not have to answer
honestly.

That is the whole game.

You wrote the form
expecting a name.

They will send you
a novel,
a script,
a knife
folded into a string.

Not because
they are all cruel,

but because
some are,

and you cannot tell them apart
at the door.

So you check
everyone.

Not the friendly ones
only.

Everyone.

The input from the browser.
The input from the other service
you wrote yourself.
The input
from the file
you saved
last year.

All of it
is a stranger
until you have looked.

Trust is not
a security policy.

It is the absence
of one.

The bug that ruins you
is rarely exotic.

It is a field
you assumed
would behave,

a number
you never checked
was a number,

a length
you never bothered
to bound.

You did not get hacked.

You got taken
at your word
you never asked them
to keep.

So validate at the edge,
loudly,
early,

and let the good data
walk in clean
while the rest
gets turned around
at the gate.

Reject with a shrug,
not a stack trace.

The error you spill
is a map
you handed
to the wrong guest.

Treat the outside world
as weather,

not as a friend.

It will send rain
when you dressed for sun,

and it owes you
no warning.

The paranoid function
is not rude.

It is simply
the one
that is still standing
tomorrow.

Assume nothing.

Check everything.

Let nothing in
that you did not
first
look in the eye.

– Serguey Asael Shinder