Security

• Explain that WebEngine helps with good defaults but does not replace secure engineering.
• Encourage treating security as an ongoing concern.

Areas to cover

• CSRF protection.
• Session and cookie safety.
• Input validation.
• Output handling.
• Secrets and configuration.
• Server configuration.

WebEngine-specific safety features

• Protected globals.
• Structured input handling.
• Request lifecycle control.
• Built-in support for secure patterns.

Common mistakes to avoid

• Leaving debug features enabled.
• Trusting raw user input.
• Binding HTML instead of text.
• Mixing sensitive logic into page views.

---

In the reference chapter, we will cover the gt commands.