SECURITY

Category: 15. Beginner / Student / Community
Section: Phase 3: Execution & Quality

12. SECURITY.md

Purpose: To define basic security practices explained simply.

Act as a security engineer who loves teaching beginners.
Using the System Architecture and PRD below, create a simple Security document for a beginner hackathon project.

ARCHITECTURE: [PASTE SYSTEM_ARCHITECTURE]
PRD: [PASTE PRD]

Provide:
1. What is an API key? (Simple explanation)
2. Why you should NEVER commit API keys to GitHub
3. How to use .env files (Step-by-step)
4. How to add .env to .gitignore
5. Basic password security (Don't store plain text)
6. Basic input validation (Don't trust user input)
7. HTTPS basics (Why it matters)
8. Free security tools (GitHub secret scanning)
9. A pre-submission security checklist for beginners
10. What to do if you accidentally exposed a secret

Explain each concept in beginner-friendly language.
Use analogies where helpful.
Do not overwhelm — focus on the 3-5 most important rules.
Keep it practical for a 24-48 hour hackathon.