security-review

Always use parameterized queries or an ORM instead of string concatenation. With Supabase, use query builder methods like .eq('email', userEmail); with raw SQL, pass values as parameters like db.query('SELECT * FROM users WHERE email = $1', [userEmail]).

Store tokens in httpOnly cookies with Secure and SameSite=Strict flags, never in localStorage which is vulnerable to XSS. Set the cookie via response headers: Set-Cookie: token=...; HttpOnly; Secure; SameSite=Strict.

Verify IAM follows least privilege with MFA enabled, secrets live in AWS Secrets Manager with rotation, security groups restrict inbound ports, databases are not publicly accessible, CloudWatch logging is enabled, and automated backups are configured.

Yes, it includes enabling RLS on all tables and creating policies so users can only select and update their own rows using auth.uid() = id. It also covers authorization role checks before sensitive operations.

localStorage is accessible to any JavaScript running on the page, so an XSS vulnerability lets attackers steal tokens. httpOnly cookies cannot be read by JavaScript, blocking this attack vector.

Use OIDC role assumption instead of long-lived credentials, run secret scanning tools like TruffleHog, audit dependencies with npm audit, enforce branch protection and code review, and grant workflows minimal permissions.