security-and-hardening

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]), or an ORM like Prisma with typed inputs. Never interpolate user input directly into query strings.

Triage audit findings by severity and reachability: fix reachable critical or high issues immediately, schedule moderate production issues for the next release, and track low-severity items. Never run npm audit fix --force blindly; preview changes, read changelogs, and test each upgrade.

Prevent SSRF by allowlisting schemes and hosts, resolving all DNS records and rejecting any private or reserved IP range, and disabling redirects. Be aware of the TOCTOU DNS-rebinding gap; for high-risk surfaces pin the resolved IP or use a filtering agent.

No, express-rate-limit keeps counters in process memory by default, so each instance counts separately and serverless invocations reset to zero. Use a shared store such as Redis via rate-limit-redis or an HTTP-based limiter like @upstash/ratelimit.

Treat all LLM output as untrusted input: never pass it to eval, SQL, a shell, or innerHTML. Parse it defensively with JSON.parse and a schema validator like zod, run only allowlisted actions, and encode it before rendering, per OWASP LLM05.

Rotate the secret immediately by revoking and reissuing the key, because deleting the line or rewriting history is not enough once it reaches a remote. After rotation, purge it from history and add env files and key extensions to .gitignore.