security-review

Use a structured security checklist covering secrets management, input validation, SQL injection prevention, XSS, CSRF, authentication, and rate limiting. Verify each item against your code, then run automated tests for auth, authorization, and rate limits before deploying.

Always use parameterized queries or an ORM instead of string concatenation. For example, pass user input as bound parameters like db.query('SELECT * FROM users WHERE email = $1', [email]) or use Supabase query builders that sanitize inputs automatically.

Store tokens in httpOnly cookies, not localStorage, because localStorage is accessible to JavaScript and vulnerable to XSS attacks. Set cookies with HttpOnly, Secure, and SameSite=Strict flags to prevent token theft and CSRF.

Yes, the companion cloud-infrastructure-security reference covers IAM least privilege, secrets manager rotation, VPC security groups, CloudWatch logging, CI/CD pipeline hardening with OIDC, Cloudflare WAF rules, and automated backup configuration.

A checklist catches common vulnerability patterns but cannot replace penetration testing, dynamic scanning, or professional security audits. It also depends on reviewer diligence and does not automatically detect logic flaws unique to your business rules.