security-review

Run through a structured checklist covering secrets management, input validation, SQL injection, XSS, CSRF, authentication, and rate limiting. Verify each item with concrete FAIL/PASS code patterns and finish with a pre-deployment gate covering headers, logging, and dependencies.

Always use parameterized queries or the Supabase query builder instead of string concatenation. Pass user values as bound parameters, for example db.query('SELECT * FROM users WHERE email = $1', [email]), never interpolated into the SQL string.

Store tokens in httpOnly, Secure, SameSite=Strict cookies rather than localStorage. localStorage is readable by any JavaScript on the page, making tokens vulnerable to theft via XSS attacks, while httpOnly cookies are inaccessible to scripts.

Yes, it includes Row Level Security guidance with example policies that restrict users to viewing and updating only their own rows via auth.uid(). It requires RLS to be enabled on all tables as part of the pre-deployment checklist.

A checklist catches common vulnerability classes but cannot replace penetration testing or runtime analysis. It relies on reviewer diligence and does not automatically scan code, so combine it with npm audit, automated security tests, and manual review of edge cases.