security-and-hardening

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma also parameterize inputs automatically when using their query methods.

Define a zod schema describing allowed fields, types, and constraints, then call safeParse on the request body in the route handler. Return a 422 response with flattened error details when validation fails, and use the typed result data when it succeeds.

Set cookies with httpOnly to block JavaScript access, secure to require HTTPS, and sameSite lax for CSRF protection. Store the session secret in an environment variable and disable resave and saveUninitialized.

Triage by severity and reachability: fix critical or high vulnerabilities immediately if the vulnerable code path is reachable, update to patched versions when available, and document deferred fixes with a reason and review date. Dev-only moderate issues can wait for regular dependency updates.

localStorage is accessible to any JavaScript running on the page, so an XSS vulnerability can steal tokens stored there. Use httpOnly cookies for session tokens instead, which JavaScript cannot read.