security-checklist

SQL injection and XSS prevention requires input validation, parameterized queries, and output encoding. Use libraries like validator for sanitization, bcrypt for password hashing, and express middleware like helmet for security headers. Apply OWASP Top 10 prevention strategies during development and security reviews.

Authentication and authorization best practices include password hashing with bcrypt, implementing MFA with speakeasy and QR codes, using JWT tokens, and role-based or attribute-based access control (RBAC/ABAC). Secure cookie handling with cookie-parser and CSRF protection via csurf mitigate common vulnerabilities.

Secure secrets management involves storing credentials in environment files with dotenv, using cloud vaults like AWS KMS or Azure Key Vault, and never committing secrets to version control. Apply input validation with zod, implement rate limiting with express-rate-limit, and validate configurations against OWASP standards.

Use helmet to set critical security headers, cors to control cross-origin requests, csurf for CSRF protection, and express-rate-limit to prevent brute-force attacks. Combine these with multer file upload validation and secure cookie configuration to defend against common web vulnerabilities.

Identify vulnerabilities using npm audit for Node.js dependencies, Snyk for continuous scanning, and Trivy for container images. Conduct security reviews against the OWASP Top 10, validate input handling, check authentication mechanisms, and audit secrets management before deployment.

Yes, the guidance covers server-side authentication, authorization, and secrets management alongside client-facing input validation, CSRF protection, and security headers. It applies across full-stack development, security reviews, vulnerability scans, and incident response exercises.