Security Skill

To prevent query injection in Cypher, you must use parameterized queries rather than string concatenation. This approach separates query logic from data inputs, ensuring user-supplied values are treated strictly as parameters and cannot execute malicious graph database operations.

Implement authentication and authorization for API routes by following a route security checklist that verifies user identity and enforces ownership verification. This ensures only authenticated users access protected endpoints and can only interact with resources they explicitly own.

Ownership verification is a security pattern confirming a user has rights to a specific resource before processing their request. You need it during route development to prevent unauthorized access, paired with secure error handling that avoids exposing sensitive system information in responses.

The best way to review code for security vulnerabilities is to use a dedicated code review checklist focused on security patterns. This checklist guides you through critical checks like parameterized Cypher queries, proper authorization, and safe error handling to maintain a robust security posture.

An API endpoint might fail a security posture review if it lacks proper ownership verification or uses vulnerable Cypher queries. Authentication alone is insufficient; you must also enforce authorization checks and follow secure error handling guidelines to pass code review.