# Lekando API Security Checklist

License: CC BY 4.0 · Source: Lekando original template

- [ ] Keep secrets in server-side environment variables
- [ ] Authenticate before paid or sensitive operations
- [ ] Validate type, length and allowed fields
- [ ] Apply short-window rate limits and daily quotas
- [ ] Never log Authorization headers or API keys
- [ ] Return safe errors with a request ID
- [ ] Set timeouts and handle provider failure
- [ ] Review dependency vulnerabilities
- [ ] Document data retention and deletion