Never trust any input! Validate input from all untrusted sources – use whitelists not blacklists Plan for security from the start – it’s not something you