futurice/backend-best-practices

Features

• Engineering Best Practices - Provides a comprehensive collection of architectural guidelines and operational standards for building secure, maintainable server-side systems.
• Secrets Management - Decouples sensitive credentials from source code by injecting them through secure external configuration files.
• Security and Access Control - Establishes comprehensive security measures including encryption, secret management, and access controls for production environments.
• Sensitive Data Encryption at Rest - Protects sensitive information through encryption, password hashing, and externalized secret management.
• Health Monitoring Endpoints - Exposes aggregated health status endpoints to facilitate automated monitoring and load balancing.
• Audit Logging Standards - Captures a permanent sequence of system actions and actor identities to ensure accountability and transparency for all sensitive operations.
• System Monitoring and Auditing - Captures chronological sequences of system events to ensure transparency and traceability for sensitive operations.
• Build Metadata Manifests - Include a detailed bill of materials with every build to track SDK versions, dependencies, and revision hashes for consistent auditing and improved traceability across all releases.
• Build Metadata Manifests - Attaches a comprehensive bill of materials to every build artifact to provide full traceability of dependencies and versions.
• Containerized Development Environments - Provides standardized container configurations to ensure environment parity across development and production stages.
• Environment Parity - Standardizes software stacks across development and production environments using isolated containers to eliminate configuration drift.
• API Rate Limiters - Restricts request frequencies to mitigate brute-force attacks and prevent unauthorized data scraping.
• Data Anonymization - Removes personally identifiable information from datasets before sharing them with third parties to protect user privacy.
• Data Anonymization Pipelines - Removes personally identifiable information from datasets before external sharing to maintain user privacy and compliance.
• Data Privacy Compliance - Implements data sanitization pipelines to remove personally identifiable information and ensure regulatory compliance.
• Encrypted Secret Management - Provides frameworks for secure, externalized secret storage and encrypted configuration management.
• Inbound Request Throttling - Limits the frequency of login attempts and specific application actions per client to mitigate brute-force attacks.
• File and Folder Permissions - Enforces strict ownership and access controls on application files and directories to prevent unauthorized cross-application access.
• Development Environment Standardization - Defines practices for standardizing toolchains and configurations across developer machines and deployment environments.
• Rate Limiting - Restricts the frequency of incoming client actions to mitigate brute-force attacks and prevent unauthorized data scraping.
• Software Architecture Guidelines - Defines architectural frameworks for implementing robust health monitoring, request throttling, and secure data handling.
• Software Bill of Materials Generators - Generates comprehensive inventories of software components and dependencies during the build process for full traceability.
• Software Engineering Standards - Establishes engineering conventions for environment consistency, observability, and data security.
• Audit Logging Systems - Implements infrastructure-level audit trails to record system activities and ensure accountability.
• Application Health Monitors - Aggregates subsystem health checks into a single status endpoint to provide a clear overview of application availability.

Star history