security-hardening-auditor

Install next-auth@beta and define an auth.ts file exporting handlers, signIn, signOut, and auth. Configure providers like Google and Credentials, use JWT session strategy with role embedded in token callbacks, and protect routes through middleware that redirects unauthenticated requests.

Run through all ten categories from broken access control to SSRF, checking authentication, authorization ownership checks, headers, input validation, and query safety. The output is a severity-rated report listing critical, high, and medium findings with locations and remediations.

Use @upstash/ratelimit with @upstash/redis for serverless Next.js routes, configuring sliding window limits such as 5 attempts per 15 minutes on auth endpoints. For Fastify, register @fastify/rate-limit with a max count, time window, and IP-based key generator.

Prisma parameterizes all standard queries automatically, making them safe by default. Raw queries must use tagged template literals like $queryRaw with interpolated variables; never pass user input into $queryRawUnsafe string concatenation.

Configure X-Frame-Options DENY, X-Content-Type-Options nosniff, Strict-Transport-Security with one-year max-age, Referrer-Policy, Permissions-Policy, and a Content-Security-Policy restricting script, style, image, and connect sources in next.config.ts.

Startup validation with @t3-oss/env-nextjs and Zod fails fast when required secrets like DATABASE_URL or AUTH_SECRET are missing, preventing runtime failures in production. It also enforces constraints such as a minimum 32-character auth secret.