ecc-security-review

Run through a structured checklist covering secrets management, input validation, SQL injection, XSS, CSRF, authentication, and rate limiting. This skill provides FAIL/PASS code examples and verification steps for each area, plus a pre-deployment checklist.

Always use parameterized queries instead of string concatenation. With Supabase, use the query builder methods like .eq('email', userEmail), or pass values as parameters in raw SQL like 'WHERE email = $1' with a parameter array.

Store tokens in httpOnly cookies, not localStorage, because localStorage is vulnerable to XSS attacks. Set cookies with HttpOnly, Secure, and SameSite=Strict flags to prevent client-side script access and cross-site request forgery.

Yes, the checklist includes Supabase-specific guidance like Row Level Security policies and Next.js patterns for CSP headers and API route protection. It also covers React's built-in XSS protections and DOMPurify sanitization.

Use Zod to define validation schemas for all user inputs, as shown in the checklist examples. Validate with whitelist rules, restrict file uploads by size, type, and extension, and avoid leaking sensitive details in validation error messages.