security-hardening

Prevent SQL injection by always using parameterized queries instead of string interpolation. In Node.js use placeholders like db.query("SELECT * FROM users WHERE email = $1", [email]); in Python use cursor.execute with %s parameters. An ORM or query builder handles this automatically.

Validate input at the boundary using a schema library like Zod. Define a schema with type, length, format, and range constraints, then call safeParse on the request body and return 400 with field errors on failure. Prefer allowlists over denylists.

Set Strict-Transport-Security with a long max-age, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, and a restrictive Content-Security-Policy. Middleware like helmet for Node.js applies these headers on every response.

CSRF protection is not needed for APIs using Bearer tokens, because browsers do not automatically attach the Authorization header to cross-site requests. CSRF tokens are required only when authentication relies on cookies sent automatically by the browser.

Scan for leaked secrets using gitleaks: run gitleaks detect --source . --verbose to search git history, and gitleaks protect --staged as a pre-commit hook to block new secret commits. Tools like trufflehog and git-secrets serve the same purpose.

JWT payloads are base64 encoded, not encrypted, so anyone holding the token can read them. Never store sensitive data in the payload, keep access token expiry short (around 15 minutes), and validate iss, aud, exp, and nbf claims on every request.