security-and-hardening

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma also parameterize inputs automatically when used with their query APIs.

Validate input at the route handler using a schema library like zod, defining types, length limits, and enums for each field. Return a 422 response with structured error details when safeParse fails, and only pass validated data to services.

Prevent SSRF by allowlisting hosts, requiring HTTPS, resolving all DNS records, and rejecting any private or reserved IP ranges including 169.254.169.254. Disable redirects and be aware of DNS-rebinding TOCTOU gaps on high-risk surfaces.

No, npm audit only catches known CVEs and will not detect malicious or typosquatted packages. Also commit the lockfile, install with npm ci in CI, review new dependencies before adding them, and watch for postinstall scripts.

Treat all LLM output as untrusted input: never pass it into eval, SQL, shell commands, or innerHTML. Parse it defensively with JSON.parse and schema validation, run only allowlisted actions, and encode it before rendering.

Rotate the secret immediately by revoking and reissuing the key, because deleting the line or rewriting history is not sufficient. Assume any secret that reaches a remote repository is compromised, then purge it from history.