# Security

## Built-in primitives

- JWT guard
- API key manager
- CORS profiles
- CSRF protector
- Secrets manager
- Audit logger

## Best practices

- Rotate secrets and keys
- Use strict CORS in production
- Enforce authz checks for sensitive routes
- Log security events with correlation IDs
