Security Checklist

Secrets Management

Rules

NEVER:
  - Hardcode secrets in source code
  - Commit .env files to git
  - Log secrets or tokens
  - Pass secrets via URL parameters
  - Store secrets in localStorage

ALWAYS:
  - Use environment variables
  - Use secret managers (Vault, AWS Secrets Manager, etc.)
  - Rotate secrets regularly
  - Use different secrets per environment
  - Add .env to .gitignore BEFORE first commit

.gitignore (Security Essentials)

.env
.env.*
*.pem
*.key
*.p12
*.pfx
credentials.json
service-account.json

Detect Leaked Secrets

# Scan git history for secrets
npx secretlint "**/*"
# or
trufflehog filesystem .
# or
gitleaks detect

Input Validation

// ✅ Validate and sanitize all input
import { z } from 'zod';

const UserInput = z.object({
  email: z.string().email().max(255),
  name: z.string().min(1).max(100).trim(),
  age: z.number().int().min(0).max(150),
});

// ❌ Never trust raw input
app.post('/users', (req, res) => {
  const data = UserInput.parse(req.body); // throws on invalid
});

SQL Injection Prevention:

// ✅ Parameterized queries
db.query('SELECT * FROM users WHERE id = $1', [userId]);

// ❌ NEVER string concatenation
db.query(`SELECT * FROM users WHERE id = ${userId}`);

Authentication & Authorization

Password Storage

// ✅ bcrypt with cost factor ≥ 12
import bcrypt from 'bcrypt';
const hash = await bcrypt.hash(password, 12);
const match = await bcrypt.compare(input, hash);

// ❌ NEVER: MD5, SHA1, SHA256 without salt, plaintext

JWT Best Practices

Rate Limiting

// Apply to auth endpoints
rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5,                     // 5 attempts
  message: 'Too many attempts, try again later'
});

HTTP Security Headers

// Use helmet.js or set manually
{
  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
  'X-Content-Type-Options': 'nosniff',
  'X-Frame-Options': 'DENY',
  'Content-Security-Policy': "default-src 'self'",
  'Referrer-Policy': 'strict-origin-when-cross-origin',
  'Permissions-Policy': 'camera=(), microphone=(), geolocation=()'
}

Dependency Audit

# Node.js
npm audit
npm audit fix

# Python
pip audit
safety check

# Check for outdated deps
npm outdated
pip list --outdated

Automate with:

• GitHub Dependabot
• Snyk
• Socket.dev

Pre-Deployment Security Review

• No secrets in code or git history
• All inputs validated and sanitized
• SQL queries parameterized
• Authentication on all protected routes
• Authorization checks (not just auth)
• HTTPS enforced
• Security headers set
• Rate limiting on auth/sensitive endpoints
• Dependencies audited (npm audit)
• Error messages don't leak internals
• Logging captures auth events (not secrets)
• CORS configured (not * in production)
• File uploads validated (type, size, content)
• Admin panels protected and not exposed