security-and-hardening

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma also parameterize inputs automatically when used with their query APIs.

Protect against SSRF by enforcing an https-only scheme, an explicit host allowlist, and DNS resolution checks that reject any private or reserved IP range. Disable redirects and be aware of DNS-rebinding TOCTOU gaps on high-risk surfaces.

Session cookies should be httpOnly so JavaScript cannot read them, secure so they only travel over HTTPS, and sameSite set to lax or strict for CSRF protection. Hash passwords with bcrypt at 12 or more salt rounds and never store tokens in localStorage.

Treat all LLM output as untrusted input per OWASP LLM05. Never pass model output into eval, SQL, shell commands, or innerHTML; instead parse it defensively, validate it against a schema, and encode it before rendering.

Fix critical and high severity vulnerabilities immediately if the vulnerable code is reachable in production. Moderate issues can wait for the next release cycle, and low severity items can be handled during regular dependency updates with a documented review date.

Rotate the secret immediately by revoking and reissuing the key, because deleting the line or rewriting history is not sufficient once it reaches a remote. After rotation, purge it from history and add env files to .gitignore.