API level: All REST request bodies and path parameters are checked through schema validation. Invalid requests are rejected before reaching the business logic.

Database level: Only parameterized queries — no string concatenation, no raw SQL. This prevents SQL injection by design.

WAF level: JSON content-type is enforced on API requests. Known injection patterns are automatically blocked.

Frontend level: Vue 3 auto-escaping in templates. Secure DOM handling for HTML content (no direct insertion of raw HTML).

File uploads: Size checks and content-type validation for document uploads.

Error handling: Error messages contain no stack traces or internal details. 404 and 403 responses are returned without a body. Error reports are automatically cleansed of PII.