Learn how to make Clojure systems safer by default through deny-by-default routing, bounded resource use, explicit parsing rules, and failure behavior that narrows rather than widens risk.
Secure defaults and defensive programming are closely related but not identical:
In a Clojure codebase, both ideas work best when the system is explicit about:
Safer defaults often look restrictive:
1(def default-flags
2 {:enable-admin-tools? false
3 :allow-unsafe-dev-shortcuts? false
4 :max-batch-size 500
5 :max-upload-bytes (* 10 1024 1024)})
This does not guarantee security, but it prevents “forgot to harden the default” from becoming the first incident.
When critical context is missing, do not silently continue with a broad fallback. Examples:
The defensive posture is to stop or reject, not to guess.
Security is not only confidentiality and authorization. It is also resilience against exhaustion:
That means defensive programming should include operational ceilings, not just validation logic.
One recurring defensive pattern in Clojure is to keep parsing and normalization explicit instead of letting values stay loosely typed for too long:
1(defn parse-page-size [raw]
2 (let [n (Integer/parseInt raw)]
3 (if (<= 1 n 200)
4 n
5 (throw (ex-info "Invalid page size" {:page-size raw})))))
The goal is not endless small parser functions for style points. The goal is to avoid a system where stringly typed data flows too far before anyone constrains it.
There is a bad form of defensiveness that hides errors:
A defensive system should narrow risk, not make failure harder to detect.
High-value areas include:
These are the places where one unchecked assumption can become a chain reaction.
If the code path still boots with unsafe options unless someone remembers to change them, the default is not really secure.
Suppressing the error is not the same thing as containing the risk.
Many production incidents are defensive-programming failures in disguise because no one bounded the retry or resource loop.
For example, a missing tenant becoming “use the default tenant” or a missing identity becoming “treat as internal.”
Make the safe path the ordinary path, reject ambiguous privileged cases, and put clear resource ceilings around code that handles untrusted input or external systems. Then keep failures visible enough that operators can investigate them instead of silently widening risk. In Clojure, defensive programming is strongest when it narrows assumptions early and keeps the failure mode explicit.