I am currently developing some web tools (http server, peer to peer, ...) in Common Lisp, and I deal with datas such as ledger transactions for cryptocurrency systems or payments via Braintree/Paypal. Even if it is a modest personal project, I would like to provide security for it.
Excluding the security at "http protocol level", at application level, sanitizing the user input wherever I can, and not using the
eval function, I am clueless with the "language and libraries level".
I use SBCL (a lisp compiler/interpreter) : http://www.sbcl.org/
...And some libraries which can call C functions at lowest level via CFFI : https://common-lisp.net/project/cffi/
What I fear is some binary or text input sent to a node or to the web server to exploit the systems in some ways. Since I have Lisp images running, the effects could be devastating, as code is data and data is code.
However, I have not found lot of information regarding the security of such technologies. I do not believe these systems are perfect regarding security, but it seems for instance that some attacks such as stack overflow are difficult to do on Lisp.
The books and whatever I find on Internet talks a lot about C systems, or PHP, SQL or that kind of technologies, which I do not use. Is there some "general advises" or algorithms on how to test, audit, develop and extend such systems, or some practices to be safe (as much as I can) ? Where can I learn to do it ? And if it does not exist, how can I create basic ways to do this ?
Thank you for your answers.