security-review

Run a structured security review covering secrets management, input validation, SQL injection, XSS, CSRF, authentication, and rate limiting. This Skill provides checklists with correct and incorrect TypeScript patterns for each domain plus a pre-deployment verification list.

Always use parameterized queries or an ORM query builder instead of string concatenation. For example, pass user input as bound parameters like db.query('SELECT * FROM users WHERE email = $1', [email]) or use Supabase filter methods.

Store tokens in httpOnly cookies with Secure and SameSite=Strict flags, not localStorage. localStorage is accessible to JavaScript and vulnerable to XSS token theft, while httpOnly cookies cannot be read by client-side scripts.

Yes, it includes RLS guidance with SQL policy examples, such as enabling row level security on tables and creating policies so users can only select or update their own data using auth.uid() checks.

It uses Zod for schema-based validation of all user input, defining schemas with constraints like email format and string length, then parsing input before processing. File uploads are separately validated for size, MIME type, and extension.

Stack traces and internal error details reveal implementation information attackers can exploit. Return generic messages like 'An error occurred' to clients while logging full details server-side only, and never log passwords, tokens, or card numbers.