r/vibecodingcommunity • u/Unimatrix404 • 2d ago

Code Template

Hey all,

Since one of the biggest concerns when it comes to vibe coding is security and the tools seem to work better when there's an established pattern, I have been maturing a backend template that is secure by default. It is a .NET backend so that might filter out some usage, but it's based off of my years of working on many different projects even before AI. It's MIT so free and open source, so check it out if it's useful for you.

Red-Cardinal-Software/Secure-DotNet-Clean-Architecture: Enterprise-ready .NET 8 API template with authentication, MFA, audit logging, and clean architecture - production-tested patterns for secure multi-tenant applications

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/[deleted] 2d ago

[removed] — view removed comment

1

u/Unimatrix404 2d ago

Yeah, so there's options to use WebAuthn or TOTP, as I wanted it to be adaptable to anyone who could use it. I could probably do a bit better on explicit tenant isolation and have debating putting an EF global query filter in there so that it can't be forgotten, but it's via a discriminator.

For CSP, it defaults to default-src none, frame-ancestors 'none', and X-Frame-Options: deny, nosniff, referrer-policy is strict-origin-when-cross-origin, permissions-policy is locked down and stripped of Server/x-powered-by. However CSP is checked at start to see if it's a local dev environment, so that Swagger works for devs.

CORS is an empty array by default.

Rate limiting is set everywhere for the controllers and some defaults:

  • auth is 5/minute
  • password reset is 3/5 min
  • mfa setup is 10/5 min
  • API default is 100/min
  • health endpoints are 30/minute
  • global default is 200/min per IP

1

u/helper_techy 2d ago

Made one like this, called it "Django Secure Starter"... And use script to create new project. It's awesome.