Treat runtime-derived values (env vars, request data, rendered attributes) as untrusted unless they’re validated by the framework’s schema/typedefs or hardened with allowlists.

Checklist:

• Prefer typedefs/schema validation over raw string/ad-hoc parsing for security-sensitive fields (URLs, crypto material, etc.).
• For crypto keys, use typedefs.key (and restrict/validate key type/algorithm, e.g., RSA vs EC).
• Don’t let environment variables directly control production-sensitive paths/behavior; gate with explicit allowlisted logic (dev vs prod) or generate the needed config at build time.

Examples:

• Redirect URL validation:

  location = typedefs.url
  

• Public key schema:

  type = "record",
  -- ...
  public_key = typedefs.key {
  description = "The RSA public key used to validate signature.",
  encrypted = true,
  referenceable = true,
  }
  

• Avoid unsafe env-driven paths by gating:

  local prefix = "/usr/local/kong"
  if kong_config.development then
  prefix = os.getenv("KONG_LIBRARY_PREFIX") or prefix -- allowlisted dev override only
  end
  prepare_prefixed_interface_dir(prefix, "gui", kong_config)
  

Apply this consistently to prevent path traversal/config injection, incorrect header handling, and weak or missing validation for URLs and cryptographic inputs.