security-and-hardening

Harden web application code by enforcing safe input handling at boundaries, applying defensive authentication and authorization checks per endpoint, and using parameterized queries to mitigate injection attacks.

Prevent XSS and SQL injection by encoding output to avoid cross-site scripting and using parameterized queries for data access, ensuring untrusted inputs from API routes and form submissions are validated defensively.

Configure secure session cookies and authentication by enforcing password hashing, applying secure session cookie practices, implementing rate limiting on authentication endpoints, and mandating authorization checks.

Yes, you can secure third-party integrations and file uploads by validating untrusted inputs at the system boundary using schemas and applying defensive handling where sensitive secrets and untrusted data are involved.

Manage secrets and operational security by keeping secrets out of code and commits, avoiding sensitive logging, configuring security headers and CORS restrictions, and triaging vulnerabilities using npm audit.

Create a prioritized hardening checklist by reviewing your current authentication and input-handling code, mapping findings against OWASP Top 10 vulnerabilities, and applying a repeatable vulnerability and audit review workflow.