Security and Access Control
Security spans authentication, authorization, input handling, and output escaping. Know ACL: acl.xml declares resources, admin users are assigned roles, and _isAllowed() checks in controllers plus Acl checks in UI components gate access. For APIs, know token types and scopes. For storefront, know CSRF form key validation, XSS prevention via escaping in templates, and SQL injection prevention via prepared statements and repositories.
Traps: assuming hiding a UI element enforces authorization (it does not; server-side ACL is required), forgetting form key validation on POST actions, and confusing authentication (who you are) with authorization (what you may do). Also know the admin security features: two-factor authentication, admin action logs, and the security.txt mechanism. Password hashing uses a salted hash; never store plaintext.
Worked example
Requirement: "Add a custom admin controller that deletes records." Declare an ACL resource in acl.xml, add it to etc/adminhtml/routes.xml or the menu as needed, and in the controller's execute() call $this->_isAllowed('Vendor_Module::delete') before acting. Do not rely on hiding the menu item; a direct URL can still hit the controller. Also require POST with form key validation for state-changing actions, so a GET link cannot trigger deletion.
Rule of thumb: every state-changing admin or API action needs an explicit server-side permission check and CSRF protection where a browser session is involved.