security-review

Run through a structured security checklist covering secrets management, input validation, SQL injection, XSS, CSRF, authentication, and rate limiting. Verify each item with concrete checks like confirming no hardcoded API keys and that all queries use parameterized statements.

Prevent SQL injection by always using parameterized queries or query builders instead of string concatenation. With Supabase, use methods like .eq() for filters, and for raw SQL pass user values as bound parameters rather than interpolating them into the query string.

Store JWT tokens in httpOnly cookies with Secure and SameSite=Strict flags, not localStorage. localStorage is accessible to JavaScript, making tokens vulnerable to theft via XSS attacks, while httpOnly cookies cannot be read by client-side scripts.

Yes, the included cloud infrastructure security reference covers AWS IAM least-privilege policies, secrets manager rotation, VPC security groups, CloudWatch logging, CI/CD hardening with OIDC, Cloudflare WAF rules, and automated RDS backups with disaster recovery.

A checklist review catches common misconfigurations and known vulnerability patterns but cannot replace penetration testing or runtime analysis. It relies on manual verification of each item and does not automatically scan dependencies or detect novel attack vectors.