security-review

Prevent SQL injection by always using parameterized queries or query builders instead of string concatenation. With Supabase use the .eq() filter methods, and with raw SQL pass values as parameters like db.query('SELECT * FROM users WHERE email = $1', [email]).

Store JWT tokens in httpOnly cookies with Secure and SameSite=Strict flags, never in localStorage which is vulnerable to XSS attacks. Set the cookie via the Set-Cookie header with a Max-Age for session expiry.

Validate file uploads by checking size limits (e.g., 5MB max), whitelisting MIME types like image/jpeg and image/png, and verifying file extensions. Always use whitelist validation rather than blacklists and never trust client-provided values.

Yes, the included cloud-infrastructure-security reference covers AWS IAM least-privilege policies, secrets manager rotation, VPC security groups, CloudWatch logging, CI/CD hardening with OIDC, Cloudflare WAF configuration, and automated RDS backups.

Stack traces expose internal implementation details that attackers can use to map your system. Return generic error messages to users while logging detailed errors only in server logs, and never log passwords, tokens, or card numbers.

A checklist catches common vulnerability patterns but cannot replace penetration testing, runtime scanning, or threat modeling for complex attack chains. It works best as a pre-deployment gate combined with automated audits like npm audit and secret scanning.