security-review

Prevent SQL injection by always using parameterized queries or an ORM query builder instead of string concatenation. For example, pass user input as bound parameters like db.query('SELECT * FROM users WHERE email = $1', [email]) or use Supabase filters such as .eq('email', userEmail).

Validate user input with Zod schemas that enforce types, formats, and length limits before processing. For file uploads, check file size against a maximum, whitelist allowed MIME types, and verify file extensions before accepting the upload.

Store JWT tokens in httpOnly cookies, not localStorage, because localStorage is accessible to JavaScript and vulnerable to XSS attacks. Set cookies with HttpOnly, Secure, and SameSite=Strict flags to prevent token theft and CSRF.

A secure CI/CD pipeline should use OIDC instead of long-lived credentials, run secret scanning with tools like TruffleHog, audit dependencies with npm audit, enforce branch protection and code review, and scan container images before deployment.

Unauthorized access usually means Row Level Security is not enabled or queries are not scoped to the authenticated user's ID. Always filter queries by the requester's ID and verify authorization roles before sensitive operations like deletions.

A checklist-based review catches common vulnerability patterns but cannot replace penetration testing, runtime monitoring, or automated scanning tools. It works best as a development-time guardrail combined with npm audit, WAF rules, and logging for defense in depth.