Choosing Secure Defaults

Secure defaults make the safe path the easiest path for both users and developers. Require explicit changes before exposing sensitive operations or data.

Examples

• Deny access when an authorization decision is unavailable.
• Keep diagnostic information out of client-facing error messages.
• Require encrypted connections for credentials and sensitive data.