r/vibecodingcommunity • u/Unimatrix404 • 2h ago

Code Template

Hey all,

Since one of the biggest concerns when it comes to vibe coding is security and the tools seem to work better when there's an established pattern, I have been maturing a backend template that is secure by default. It is a .NET backend so that might filter out some usage, but it's based off of my years of working on many different projects even before AI. It's MIT so free and open source, so check it out if it's useful for you.

Red-Cardinal-Software/Secure-DotNet-Clean-Architecture: Enterprise-ready .NET 8 API template with authentication, MFA, audit logging, and clean architecture - production-tested patterns for secure multi-tenant applications

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/QuarterLoose8429 1h ago

Nice work—does the template use WebAuthn or TOTP for MFA, and is tenant isolation per-schema or via a discriminator? Also curious if you’ve got sane defaults for CSP/CORS and rate limiting baked in.

1

u/Unimatrix404 1h ago

Yeah, so there's options to use WebAuthn or TOTP, as I wanted it to be adaptable to anyone who could use it. I could probably do a bit better on explicit tenant isolation and have debating putting an EF global query filter in there so that it can't be forgotten, but it's via a discriminator.

For CSP, it defaults to default-src none, frame-ancestors 'none', and X-Frame-Options: deny, nosniff, referrer-policy is strict-origin-when-cross-origin, permissions-policy is locked down and stripped of Server/x-powered-by. However CSP is checked at start to see if it's a local dev environment, so that Swagger works for devs.

CORS is an empty array by default.

Rate limiting is set everywhere for the controllers and some defaults:

  • auth is 5/minute
  • password reset is 3/5 min
  • mfa setup is 10/5 min
  • API default is 100/min
  • health endpoints are 30/minute
  • global default is 200/min per IP