security-and-hardening

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]), or an ORM like Prisma with typed inputs. Validate all request bodies at the route boundary with a schema validator like zod.

Protect against SSRF by allowlisting schemes and hosts, resolving all DNS records and rejecting any private or reserved IP range, and disabling redirects on outbound fetches. For high-risk surfaces, pin the resolved IP or use a filtering agent to close the DNS-rebinding TOCTOU gap.

An Express app should set CSP, HSTS, X-Frame-Options, and X-Content-Type-Options, most easily via the helmet middleware. Configure a restrictive Content-Security-Policy and limit CORS to known origins rather than using wildcard origins.

Triage npm audit results by severity and reachability: fix reachable critical and high findings immediately, schedule moderate ones for the next release, and track low ones. Never run npm audit fix --force blindly; review changelogs and test each upgrade.

No, LLM output must be treated as untrusted input. Never pass it into eval, SQL, a shell, or innerHTML; instead parse it defensively, validate it against a schema, and encode it before rendering, since model output can carry injection or stored XSS payloads.

Dependency audits only match known advisories and cannot detect newly malicious or typosquatted packages, nor prove vulnerable code is unreachable. Complement audits with lockfile integrity checks, blocked install scripts, provenance verification, and manual review of new dependencies.