Security and operations — Nexis documentation

Layer the controls

HTML escaping protects render output, allowlists protect remote fetches, trusted-origin policies protect mutations, and deployment configuration protects headers, secrets, and process behavior.

Keep secrets off the page

Never place tokens in JSX, generated HTML, client chunks, logs, or repository history. Use deployment environment variables and mask operational logs.

Plan for abuse and recovery

Set rate and body limits, use distributed idempotency for multi-instance mutations, minimize telemetry data, audit dependencies, and document an incident path.

PRACTICAL LABS

Run this capability.

Each example states the observable output, the boundary that remains your responsibility, and the check that proves the result.

State a public-data boundary

Text

Safe for browser HTML/chunks: public copy, UI labels, public product data
Never expose: tokens, session IDs, private profile data, authorization decisions, server credentials

OUTPUT: The review identifies what can cross the browser boundary before build.
BOUNDARY: Escaping is not a replacement for input validation, authorization, CSRF policy, or network egress controls.
PROVE IT: Run secret scans, XSS/Origin tests, dependency review, and HTTPS header/cookie tests.

VERIFICATION

Prove the contract.

Test XSS escaping, remote URL rejection, CSRF/origin failures, cookie flags, security headers, secret scans, rate/body limits, and incident runbook access.