Bottom Line: Verify Everything

• Trust no value you receive from outside the program

• “Assert” all requirements for external input

• Do not use object serialization; write all serialization code yourself