# Secure Web Development

> Security designed in from the first commit: strict CSP, OWASP Top 10 coverage, parameter-bound queries, row-level security and per-route rate limiting.

**Provider:** Oxwyn Studio (https://oxwynstudio.com)
**Page:** https://oxwynstudio.com/services/secure-web-development

## Summary

Secure web development means building security into the architecture from the first commit, not bolting it on after launch. We hand-code Next.js sites with a strict Content Security Policy, OWASP Top 10 coverage, parameter-bound database queries, row-level security, signed cookies, per-route rate limiting and bot protection on every public form, then hand you an auditable codebase and an operations runbook.

## What this fixes

- **Your current site runs on a stack of third-party plugins.** Every plugin is a supply-chain risk, a performance tax and a renewal invoice waiting to break.
- **Forms and login pages are unprotected.** Bots scrape your inboxes, fill your CRM with junk and probe relentlessly for credential reuse.
- **You inherit a site you cannot audit.** When something breaks at 11pm, no one in the building can read the code or trace the fault.

## The method — secure SDLC

01. **Threat model** — Map the attack surface, data flows and trust boundaries before a line of code is written.
02. **Architect** — Server-first design, least-privilege access and secure defaults baked into the foundation.
03. **Harden** — Strict CSP, HSTS, secure headers, parameter-bound queries, RLS and rate limits.
04. **Test** — Automated scanning, dependency audits and manual penetration testing against OWASP Top 10.
05. **Monitor** — Logging, alerting and an operations runbook so incidents are caught and contained fast.

## Defence in depth

- **Edge:** WAF · bot heuristics · DDoS absorption (WAF rules, Bot filtering, Geo controls)
- **Network:** TLS 1.3 · HSTS · rate limiting (TLS 1.3, HSTS preload, Per-route limits)
- **Application:** Strict CSP · signed cookies · CSRF defence (Strict CSP, Signed sessions, Input validation)
- **Data:** Row-level security · parameter-bound queries · encryption (Row-level security, Parameterised queries, Encryption at rest)

## What's included

- Next.js App Router build, hand-coded and fully auditable
- Strict Content Security Policy, HSTS and secure-header configuration
- OWASP Top 10 review with documented mitigations
- Honeypot plus rate-limit on every public form
- Parameter-bound Supabase / Postgres queries with row-level security
- Signed, httpOnly cookies and CSRF-resistant server actions
- Written architecture diagram and operations runbook
- A-grade security headers verified before launch

## Security posture — six disciplines

### 01. OWASP Top 10 coverage
Every build is reviewed against the OWASP Top 10: injection, broken access control, security misconfiguration and the rest, with documented mitigations.
Techniques: Injection defence, Access control, Secure config, Crypto failures.

### 02. Content Security Policy
Strict, nonce-based CSP Level 3 that blocks cross-site scripting at the browser, plus HSTS and a full secure-header set.
Techniques: Nonce-based CSP, HSTS preload, Frame ancestors, Referrer policy.

### 03. Database hardening
Row-level security and parameter-bound queries mean a compromised query can never read another tenant's data or run injected SQL.
Techniques: Row-level security, Parameterised queries, Least privilege, Encryption.

### 04. Bot & abuse protection
Per-route rate limiting, honeypots and bot heuristics on every public surface so forms and logins stay clean and credential-stuffing fails.
Techniques: Rate limiting, Honeypots, Bot heuristics, CAPTCHA-free defence.

### 05. Privacy & compliance
GDPR-aware data handling, signed and httpOnly cookies, minimal data collection and clear sub-processor records for procurement.
Techniques: GDPR-aware, Cookie hardening, Data minimisation, Sub-processor records.

### 06. Auditable & owner-ready
Conventional structure, named server actions and a written runbook so any senior engineer can audit, operate and extend the build.
Techniques: Readable code, Named actions, Runbook, Dependency audits.

## Stack & security tooling

Next.js, TypeScript, Supabase, Postgres RLS, Upstash, Vercel WAF, OWASP ZAP, Snyk, Lighthouse, SecurityHeaders.com.

## FAQ

### What does secure web development actually include?

It includes threat modelling before the build, a strict Content Security Policy, OWASP Top 10 coverage, parameter-bound queries with row-level security, signed cookies, per-route rate limiting, bot protection on public forms, and a written operations runbook. Security is part of the architecture, not an add-on.

### Do you work with WordPress or page builders?

No. We migrate off them. Plugin-driven stacks are the single biggest source of supply-chain and configuration vulnerabilities we see. Hand-coded, auditable Next.js is the product.

### Do you cover the OWASP Top 10?

Yes. Every engagement is reviewed against the current OWASP Top 10, including injection, broken access control, cryptographic failures and security misconfiguration, with each mitigation documented so your team can verify it.

### Can you harden or audit an existing site?

Yes. We run a vulnerability assessment and security-headers audit, document the gaps against OWASP, then either remediate in place or plan a migration to a hardened build, depending on the state of the code.

### How do you stop bots and spam on forms?

We layer per-route rate limiting, honeypot fields and lightweight bot heuristics so junk submissions and credential-stuffing attempts fail without forcing your real users through intrusive CAPTCHAs.

### Is the site GDPR compliant?

We build GDPR-aware: data minimisation, signed and httpOnly cookies, clear consent handling and documented sub-processors. We are not a law firm, but the technical foundation maps cleanly to what your DPO needs.

### Will my team be able to maintain it?

Yes. We use a conventional file structure, named server actions and a written runbook, so any senior engineer can read, audit and extend the build. You are never locked to us.

### Do you provide penetration testing?

We run automated scanning and dependency audits as standard, and offer manual penetration testing against the OWASP Top 10 as part of larger engagements or on request.

## Keywords

secure web development, OWASP Top 10, Content Security Policy, secure Next.js development, web application security, penetration testing, secure SDLC, application hardening, row-level security, rate limiting, HSTS, GDPR-compliant website, bot protection, secure HTTP headers, vulnerability assessment, zero-trust web architecture

## Next step

Book a security review: https://oxwynstudio.com/contact