Application security guide
Apply Easel platform controls alongside secure application design.
Easel provides platform protections, firewall rules, Attack Mode, deployment protection, managed TLS, and security telemetry. These controls complement application security; they do not replace it.
Protect non-production deployments
Require authentication or an access policy for Preview deployments that contain unreleased features, customer data, or privileged APIs.
Do not assume an unlinked deployment URL is private.
Store secrets outside source control
Use environment variables or the supported secret mechanism. Separate Preview and Production credentials, rotate exposed values, and avoid logging tokens or session data.
Restrict application access
Implement authentication and authorization in the application. A firewall can block traffic patterns, but it cannot determine whether a signed-in user may access a specific business object.
Use narrow firewall rules
Start with logging when possible, inspect matched traffic, and then enforce. Avoid broad IP or user-agent rules that can block legitimate users or be trivially bypassed.
Protect sensitive endpoints
Apply stricter controls to login, password reset, account recovery, administrative APIs, uploads, and expensive mutations. Use rate limiting when available and application-level quotas where identity-aware enforcement is required.
Validate all input
Validate request bodies, query parameters, headers, file uploads, and webhook signatures. Treat rewritten or proxied requests as untrusted input.
Secure cookies and headers
Use Secure, HttpOnly, and appropriate SameSite cookie settings. Configure CSP, HSTS, frame restrictions, and other response headers according to the application's requirements.
Review dependencies
Keep frameworks, adapters, runtime packages, and lockfiles current. Test upgrades in Preview before promotion.
Monitor and respond
Review security events and unusual error or traffic patterns. Keep a rollback plan, credential-rotation procedure, and contact path for reporting vulnerabilities.
See Shared responsibility for the division between Easel and application responsibilities.