Security Engineer

Secure authentication uses JWT, session-based, or OAuth methods combined with bcrypt password hashing (12+ rounds). Choose one approach, validate all input with Zod, enforce HTTPS, and log authentication events for audit trails.

OWASP Top 10 prevention requires input validation with Zod, parameterized queries to block SQL injection, security headers (CSP, HSTS, X-Frame-Options), rate limiting, and helmet middleware. Apply these across authentication, authorization, and data handling.

Use express-rate-limit for login throttling (5 attempts per 15 minutes), helmet for automatic security headers, express-mongo-sanitize for input sanitization, and compression middleware. Configure HTTPS enforcement and audit logging for API endpoints.

API security checklists and workflows guide you through authentication, authorization, input validation, encryption, and monitoring. Dependencies like bcrypt, jose, helmet, and rate-limit automate secure configuration; security reviews validate your implementation.

Data protection combines encryption with secure secret management and parameterized database queries using PostgreSQL. Jose handles JWT encryption, bcrypt secures passwords, and audit logging tracks access to sensitive data throughout the application lifecycle.

Security audits use comprehensive checklists covering authentication, authorization, input validation, encryption, rate limiting, HTTPS, and audit logging. Review each layer against OWASP guidelines and apply fixes incrementally with helmet, Zod validation, and monitoring.