Security Basics

• Principle of least privilege: functions get only the permissions they need.
• Secrets via managed secret stores, not env-hardcoding.
• Validate all inputs (even from internal events).
• Keep dependencies minimal to reduce attack surface.