kai omo see developers of 2026, anticipating user mistakes is foundational to implementing robust security(never trust user ) during SSDLC.
1.Input normalization->sanitation->Validation
2.PoLP
3.Failsafe Authentication & Authorization
4.Automated Security Testing
these must be implemented for a hosting platform. and mind you its not users mistake. for a self hostng platform one is that the login is already flawed (password based login) codes would have been implemented and codes for admin users can only be generated by aeroplane cli, by this even a user who is a victim of key log, mitm,sesion thief didnt comprise platform. simple policy,
simple policy root have 3 login methods, pam,password base,codes, codes are only generated by cli and are used ones , root can create account for users select features they have access to and define their auth method this totally kills , keylogs , mitm, seesion thief vulnerabilities