diff --git a/src/lib/csrf.ts b/src/lib/csrf.ts
new file mode 100644
index 0000000..b2d885b
--- /dev/null
+++ b/src/lib/csrf.ts
@@ -0,0 +1,81 @@
+import type { Context, Next } from 'hono';
+import { getCookie, setCookie } from 'hono/cookie';
+
+const CSRF_COOKIE_NAME = 'csrf_token';
+const CSRF_HEADER_NAME = 'x-csrf-token';
+const CSRF_FORM_FIELD = '_csrf';
+
+/**
+ * Generate a cryptographically secure random token
+ */
+function generateToken(): string {
+  const buffer = new Uint8Array(32);
+  crypto.getRandomValues(buffer);
+  return Array.from(buffer, b => b.toString(16).padStart(2, '0')).join('');
+}
+
+/**
+ * Get or create a CSRF token for the current session
+ */
+export function getCSRFToken(c: Context): string {
+  let token = getCookie(c, CSRF_COOKIE_NAME);
+  
+  if (!token) {
+    token = generateToken();
+    setCookie(c, CSRF_COOKIE_NAME, token, {
+      httpOnly: true,
+      secure: process.env.PUBLIC_URL?.startsWith('https') || false,
+      sameSite: 'Strict',
+      path: '/',
+      maxAge: 60 * 60 * 24, // 24 hours
+    });
+  }
+  
+  return token;
+}
+
+/**
+ * Middleware to validate CSRF token on POST/PUT/DELETE requests
+ */
+export async function csrfProtection(c: Context, next: Next) {
+  const method = c.req.method.toUpperCase();
+  
+  // Only check CSRF for state-changing methods
+  if (['POST', 'PUT', 'DELETE', 'PATCH'].includes(method)) {
+    const cookieToken = getCookie(c, CSRF_COOKIE_NAME);
+    
+    if (!cookieToken) {
+      return c.text('CSRF token missing', 403);
+    }
+    
+    // Check header first (for AJAX requests)
+    let requestToken = c.req.header(CSRF_HEADER_NAME);
+    
+    // Fall back to form field
+    if (!requestToken) {
+      const contentType = c.req.header('content-type') || '';
+      if (contentType.includes('application/x-www-form-urlencoded') || 
+          contentType.includes('multipart/form-data')) {
+        try {
+          const body = await c.req.parseBody();
+          requestToken = body[CSRF_FORM_FIELD] as string;
+        } catch {
+          // Body might have already been parsed
+        }
+      }
+    }
+    
+    if (!requestToken || requestToken !== cookieToken) {
+      return c.text('CSRF token invalid', 403);
+    }
+  }
+  
+  await next();
+}
+
+/**
+ * HTML helper to generate a hidden CSRF input field
+ */
+export function csrfField(token: string): string {
+  return `<input type="hidden" name="${CSRF_FORM_FIELD}" value="${token}" />`;
+}
diff --git a/src/lib/oauth.ts b/src/lib/oauth.ts
index ed2e89b..9ea910d 100644
--- a/src/lib/oauth.ts
+++ b/src/lib/oauth.ts
@@ -89,8 +89,8 @@ async function getOrCreatePrivateKey(): Promise<JoseKey> {
   const key = await JoseKey.generate(['ES256'], crypto.randomUUID());
   const jwk = key.privateJwk;
   
-  // Save to disk
-  fs.writeFileSync(KEYS_PATH, JSON.stringify(jwk, null, 2));
+  // Save to disk with restrictive permissions (owner read/write only)
+  fs.writeFileSync(KEYS_PATH, JSON.stringify(jwk, null, 2), { mode: 0o600 });
   
   return key;
 }
diff --git a/src/lib/validation.ts b/src/lib/validation.ts
new file mode 100644
index 0000000..affa610
--- /dev/null
+++ b/src/lib/validation.ts
@@ -0,0 +1,30 @@
+/**
+ * Validate that a string is a valid TID (Timestamp ID)
+ * TIDs are base36 encoded and should be 13 characters
+ */
+export function isValidTID(tid: string): boolean {
+  if (!tid || typeof tid !== 'string') return false;
+  // TID should be 13 characters of base36 (0-9, a-z)
+  return /^[0-9a-z]{13}$/.test(tid);
+}
+
+/**
+ * Validate that a URL is a valid HTTPS URL
+ */
+export function isValidHttpsUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === 'https:';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Sanitize a string for safe display (basic XSS prevention)
+ * Note: Hono's html template already escapes, but this is defense in depth
+ */
+export function sanitizeString(str: string, maxLength: number = 1000): string {
+  if (!str || typeof str !== 'string') return '';
+  return str.slice(0, maxLength);
+}
diff --git a/src/routes/auth.ts b/src/routes/auth.ts
index 709a778..8650d6d 100644
--- a/src/routes/auth.ts
+++ b/src/routes/auth.ts
@@ -3,6 +3,7 @@ import { getCookie, setCookie, deleteCookie } from 'hono/cookie';
 import { html } from 'hono/html';
 import { getOAuthClient, getClientMetadata, getJwks, deleteSession } from '../lib/oauth';
 import { layout } from '../views/layouts/main';
+import { csrfField } from '../lib/csrf';
 
 export const authRoutes = new Hono();
 
@@ -31,6 +32,7 @@ authRoutes.get('/jwks.json', async (c) => {
 // Login page
 authRoutes.get('/login', async (c) => {
   const error = c.req.query('error');
+  const csrfToken = c.get('csrfToken') as string;
   
   const content = html`
     <div class="auth-form">
@@ -46,6 +48,7 @@ authRoutes.get('/login', async (c) => {
       ` : ''}
       
       <form action="/auth/login" method="POST">
+        ${csrfField(csrfToken)}
         <div class="form-group">
           <label for="handle">Handle or DID</label>
           <input 
diff --git a/src/routes/documents.ts b/src/routes/documents.ts
index c96cb3f..80a7d37 100644
--- a/src/routes/documents.ts
+++ b/src/routes/documents.ts
@@ -2,6 +2,8 @@ import { Hono } from 'hono';
 import { html, raw } from 'hono/html';
 import { layout } from '../views/layouts/main';
 import { requireAuth, type Session } from '../lib/session';
+import { csrfField } from '../lib/csrf';
+import { isValidTID } from '../lib/validation';
 
 export const documentRoutes = new Hono();
 
@@ -120,11 +122,14 @@ documentRoutes.get('/new', async (c) => {
     // No publication yet, will need URL
   }
 
+  const csrfToken = c.get('csrfToken') as string;
+
   const content = html`
     <div class="form-page">
       <h1>New Document</h1>
       
       <form action="/documents/new" method="POST" class="document-form">
+        ${csrfField(csrfToken)}
         <input type="hidden" name="publicationUri" value="${publicationUri}" />
         
         <div class="form-group">
@@ -256,6 +261,11 @@ documentRoutes.get('/:rkey', async (c) => {
   }
 
   const rkey = c.req.param('rkey');
+  
+  // Validate rkey format
+  if (!isValidTID(rkey)) {
+    return c.redirect('/documents');
+  }
 
   try {
     const response = await session.agent!.com.atproto.repo.getRecord({
@@ -266,6 +276,7 @@ documentRoutes.get('/:rkey', async (c) => {
 
     const doc = response.data.value as any;
     const isDraft = (doc.tags || []).includes('draft');
+    const csrfToken = c.get('csrfToken') as string;
 
     const content = html`
       <div class="document-view">
@@ -288,14 +299,17 @@ documentRoutes.get('/:rkey', async (c) => {
           <a href="/documents/${rkey}/edit" class="btn btn-primary">Edit</a>
           ${isDraft ? html`
             <form action="/documents/${rkey}/publish" method="POST" style="display:inline">
+              ${csrfField(csrfToken)}
               <button type="submit" class="btn btn-success">Publish</button>
             </form>
           ` : html`
             <form action="/documents/${rkey}/unpublish" method="POST" style="display:inline">
+              ${csrfField(csrfToken)}
               <button type="submit" class="btn btn-secondary">Unpublish</button>
             </form>
           `}
           <form action="/documents/${rkey}/delete" method="POST" style="display:inline" onsubmit="return confirm('Are you sure you want to delete this document?')">
+            ${csrfField(csrfToken)}
             <button type="submit" class="btn btn-danger">Delete</button>
           </form>
           <a href="/documents" class="btn btn-secondary">Back to List</a>
@@ -320,6 +334,10 @@ documentRoutes.get('/:rkey/edit', async (c) => {
   }
 
   const rkey = c.req.param('rkey');
+  
+  if (!isValidTID(rkey)) {
+    return c.redirect('/documents');
+  }
 
   try {
     const response = await session.agent!.com.atproto.repo.getRecord({
@@ -329,12 +347,14 @@ documentRoutes.get('/:rkey/edit', async (c) => {
     });
 
     const doc = response.data.value as any;
+    const csrfToken = c.get('csrfToken') as string;
 
     const content = html`
       <div class="form-page">
         <h1>Edit Document</h1>
         
         <form action="/documents/${rkey}/edit" method="POST" class="document-form">
+          ${csrfField(csrfToken)}
           <div class="form-group">
             <label for="title">Title *</label>
             <input type="text" id="title" name="title" value="${doc.title}" required maxlength="128" />
@@ -385,6 +405,11 @@ documentRoutes.post('/:rkey/edit', async (c) => {
   }
 
   const rkey = c.req.param('rkey');
+  
+  if (!isValidTID(rkey)) {
+    return c.redirect('/documents');
+  }
+  
   const body = await c.req.parseBody();
 
   try {
@@ -441,6 +466,10 @@ documentRoutes.post('/:rkey/publish', async (c) => {
   }
 
   const rkey = c.req.param('rkey');
+  
+  if (!isValidTID(rkey)) {
+    return c.redirect('/documents');
+  }
 
   try {
     const existing = await session.agent!.com.atproto.repo.getRecord({
@@ -483,6 +512,10 @@ documentRoutes.post('/:rkey/unpublish', async (c) => {
   }
 
   const rkey = c.req.param('rkey');
+  
+  if (!isValidTID(rkey)) {
+    return c.redirect('/documents');
+  }
 
   try {
     const existing = await session.agent!.com.atproto.repo.getRecord({
@@ -524,6 +557,10 @@ documentRoutes.post('/:rkey/delete', async (c) => {
   }
 
   const rkey = c.req.param('rkey');
+  
+  if (!isValidTID(rkey)) {
+    return c.redirect('/documents');
+  }
 
   try {
     await session.agent!.com.atproto.repo.deleteRecord({
diff --git a/src/routes/publication.ts b/src/routes/publication.ts
index ed9a6db..c3bfb55 100644
--- a/src/routes/publication.ts
+++ b/src/routes/publication.ts
@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { html } from 'hono/html';
 import { layout } from '../views/layouts/main';
 import { requireAuth, type Session } from '../lib/session';
+import { csrfField } from '../lib/csrf';
 
 export const publicationRoutes = new Hono();
 
@@ -63,11 +64,14 @@ publicationRoutes.get('/new', async (c) => {
     return c.redirect('/auth/login');
   }
 
+  const csrfToken = c.get('csrfToken') as string;
+
   const content = html`
     <div class="form-page">
       <h1>Create Publication</h1>
       
       <form action="/publication/new" method="POST">
+        ${csrfField(csrfToken)}
         <div class="form-group">
           <label for="name">Name *</label>
           <input type="text" id="name" name="name" required maxlength="128" />
@@ -153,11 +157,14 @@ publicationRoutes.get('/edit', async (c) => {
     const pub = publication.value as any;
     const rkey = publication.uri.split('/').pop();
 
+    const csrfToken = c.get('csrfToken') as string;
+
     const content = html`
       <div class="form-page">
         <h1>Edit Publication</h1>
         
         <form action="/publication/edit" method="POST">
+          ${csrfField(csrfToken)}
           <input type="hidden" name="rkey" value="${rkey}" />
           
           <div class="form-group">
diff --git a/src/server.ts b/src/server.ts
index 658ac81..d8978fb 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -8,6 +8,7 @@ import { layout } from './views/layouts/main';
 import { homePage } from './views/home';
 import { getSession } from './lib/session';
 import { getClientMetadata, getJwks } from './lib/oauth';
+import { csrfProtection, getCSRFToken } from './lib/csrf';
 
 export const app = new Hono();
 
@@ -42,13 +43,22 @@ app.get('/jwks.json', async (c) => {
   }
 });
 
-// Session middleware - adds session to context
+// Session middleware - adds session and CSRF token to context
 app.use('*', async (c, next) => {
   const session = await getSession(c);
   c.set('session', session);
+  // Generate CSRF token for all requests (sets cookie if not present)
+  const csrfToken = getCSRFToken(c);
+  c.set('csrfToken', csrfToken);
   await next();
 });
 
+// CSRF protection for state-changing requests
+// Applied after session middleware but before routes
+app.use('/auth/*', csrfProtection);
+app.use('/publication/*', csrfProtection);
+app.use('/documents/*', csrfProtection);
+
 // Home page
 app.get('/', async (c) => {
   const session = c.get('session');
diff --git a/src/views/layouts/main.ts b/src/views/layouts/main.ts
index a2a7d30..d6df964 100644
--- a/src/views/layouts/main.ts
+++ b/src/views/layouts/main.ts
@@ -4,6 +4,7 @@ import type { Session } from '../../lib/session';
 interface LayoutOptions {
   title?: string;
   session?: Session;
+  csrfToken?: string;
 }
 
 export function layout(content: string, options: LayoutOptions = {}) {