Answer
Many lower-level technical security concerns, including authentication, CSRF, XXE, XSS, and parts of access control, are already handled by the Aurena/Marble framework itself and don't need to be separately re-implemented by page developers. The security issues that genuinely DO need active consideration during Aurena/Marble page development are: injection risks, especially SQL injection, being careful with dynamic SQL constructs like EXECUTE IMMEDIATE or DBMS_SQL; and insecure direct object references, meaning missing row-level access control or a lack of access control on unbound actions — for example applying a filter only on the client side while leaving the server-side projection's API completely open to any caller, or adding an 'enabled' check only on the client side without enforcing the same check server-side in the API itself. IFS Developer Studio includes built-in assistance for flagging these specific kinds of vulnerability scenarios, SQL injection risk and missing access checks on unbound actions, during development.