security-review

Always use parameterized queries or an ORM instead of string concatenation. Pass user input as bound parameters, for example db.query('SELECT * FROM users WHERE email = $1', [email]), never interpolate values into SQL strings.

Store tokens in httpOnly cookies with Secure and SameSite=Strict flags, never in localStorage which is vulnerable to XSS. Set the cookie via the Set-Cookie response header so JavaScript cannot access it.

Verify no hardcoded secrets, all inputs validated, parameterized queries, XSS sanitization, CSRF protection, rate limiting, HTTPS enforcement, security headers, generic error messages, and up-to-date dependencies with no known vulnerabilities.

Follow least privilege by granting only specific actions on specific resources, enable MFA for privileged accounts, use roles instead of long-lived credentials, and never use the root account in production.

Unvalidated uploads allow oversized files, malicious types, and path traversal. Enforce size limits, whitelist MIME types and extensions, and validate before processing or storing any uploaded file.