security-and-hardening

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma also parameterize inputs automatically when used with their query APIs.

Protect against SSRF by allowlisting schemes and hosts, resolving all DNS records and rejecting any private or reserved IP ranges, and disabling redirects. Note the remaining TOCTOU gap where DNS can rebind between validation and connection, so high-risk surfaces should pin the resolved IP.

Set session cookies with httpOnly to block JavaScript access, secure to require HTTPS, and sameSite to mitigate CSRF. Store the session secret in an environment variable, never in source code, and apply stricter rate limiting on authentication endpoints.

Never apply forced audit remediation automatically, since forced fixes may cross declared dependency ranges and break your application. Instead triage findings by severity and code reachability, preview the remediation, read changelogs, and test each upgrade individually.

Treat all LLM output as untrusted input: never pass it into eval, SQL, shell commands, or innerHTML. Parse model responses defensively with JSON.parse and schema validation, run only allowlisted actions, and encode output before rendering.

Rotate the secret immediately by revoking and reissuing the key, because deleting the line or rewriting history is not enough once it reaches a remote. Assume the credential is compromised the moment it is pushed, then purge it from history.