Unsafe vs safe, side by side

from flask import send_from_directory

@app.get("/files")
@login_required
def download():
    name = request.args.get("name", "")
    # refuses any path that resolves outside the folder
    return send_from_directory("/srv/reports", name)

Use the framework helper that joins safely, and still check the user may see that file.

const ALLOWED = new Set(["images.example.com", "cdn.partner.example"]);

app.get("/preview", async (req, res) => {
  let u;
  try { u = new URL(String(req.query.url)); } catch { return res.sendStatus(400); }
  if (u.protocol !== "https:" || !ALLOWED.has(u.hostname)) return res.sendStatus(400);
  const r = await fetch(u, { redirect: "error", signal: AbortSignal.timeout(5000) });
  res.type("text/plain").send((await r.text()).slice(0, 100_000));
});

An allow list of hosts, HTTPS only, no redirects, a timeout and a size cap. Block metadata addresses at the network too.

from pydantic import BaseModel, Field

class Order(BaseModel):
    sku: str = Field(pattern=r"^[A-Z0-9-]{3,32}$")
    qty: int = Field(ge=1, le=1000)

@app.post("/import")
def import_order():
    order = Order.model_validate_json(request.get_data())
    save(order)
    return "", 204

A data only format like JSON, parsed into a strict schema. Nothing in the input can run.

on: pull_request
permissions:
  contents: read
jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { persist-credentials: false }
      - uses: some-org/lint-action@5c7c2a1f0b9e4d3a8f6e2b1c0d9e8f7a6b5c4d3e # v2.3.1
      - run: npm ci && npm test

No secrets for untrusted code, a read only token, a fresh hosted runner, pinned actions and lockfile installs. (The lint action SHA is an illustration.)

pipeline {
  agent { kubernetes { yamlFile 'ci/pod.yaml' } }  // fresh pod per build
  stages {
    stage('Build') { steps { sh 'npm ci' } }
    stage('Deploy') {
      when { branch 'main' }
      steps {
        withCredentials([string(credentialsId: 'deploy', variable: 'T')]) {
          sh 'DEPLOY_TOKEN="$T" deploy'   // single quotes: shell reads it
        }
      }
    }
  }
}

An ephemeral agent, a lockfile install, deploys only from main, and a secret handed to the tool through its environment, never through Groovy or the command line.

# syntax=docker/dockerfile:1
FROM node:24-slim@sha256:<digest> AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build && npm prune --omit=dev

FROM node:24-slim@sha256:<digest>
WORKDIR /app
ENV NODE_ENV=production
COPY --from=build --chown=node:node /app/dist ./dist
COPY --from=build --chown=node:node /app/node_modules ./node_modules
USER node
CMD ["node", "dist/server.js"]

Pinned by digest, lockfile install, a .dockerignore for .git and .env, only runtime files in the final stage, and a non root user.

docker run -d --read-only --tmpfs /tmp \
  --cap-drop ALL --security-opt no-new-privileges \
  --user 10001:10001 --memory 512m --pids-limit 200 \
  -p 127.0.0.1:8080:8080 \
  registry.example.com/app@sha256:4d1f...

Read only, no capabilities, no privilege escalation, resource limits, and only reachable through the local reverse proxy.