security-review

Always use parameterized queries or an ORM instead of string concatenation. For example, pass user input as bound parameters like db.query('SELECT * FROM users WHERE email = $1', [email]) or use Supabase query builders that sanitize inputs automatically.

Store tokens in httpOnly cookies with Secure and SameSite=Strict flags, never in localStorage. localStorage is accessible to JavaScript and vulnerable to XSS token theft, while httpOnly cookies cannot be read by client-side scripts.

Verify no hardcoded secrets, all inputs validated with schemas, parameterized database queries, CSRF protection, rate limiting on endpoints, security headers configured, dependencies audited with npm audit, and Row Level Security enabled in Supabase.

Enforce three checks: a size limit such as 5MB, a whitelist of allowed MIME types like image/jpeg and image/png, and a whitelist of file extensions. Never trust the client-provided content type alone, and reject anything outside the whitelist.

Yes, a companion reference covers IAM least privilege, cloud secrets managers with rotation, VPC security groups, CloudWatch logging, CI/CD hardening with OIDC, Cloudflare WAF rules, and automated backup configuration for AWS deployments.

localStorage is readable by any JavaScript running on the page, so a single XSS vulnerability lets an attacker steal the token. httpOnly cookies block script access entirely, and SameSite=Strict additionally mitigates CSRF attacks.