security-best-practices

Express.js security middleware : Joi validation : CSRF Token : .env (never commit) : Kubernetes Secrets : JWT + Refresh Token Rotation : #security #OWASP #HTTPS #CORS #XSS #SQL-injection #CSRF #infrastructure - New project : consider security from the start - Security audit : inspect and fix vulnerabilities - Public API : harden APIs accessible externally - Compliance : comply with GDPR, PCI-DSS, etc. - HTTPS Only : HTTPS required in production - Separate secrets : manage via environment variables; never hardcode in code - Input Validation : validate all user input - Parameterized Queries : prevent SQL Injection - Rate Limiting : DDoS prevention - No eval() : code injection risk - No direct innerHTML : XSS risk - No committing secrets : never commit .env files - Principle of Least Privilege : grant minimal privileges - Defense in Depth : layered security - Security Audits : regular security reviews - OWASP Top 10 - helmet.js - Security Checklist - Current version : 1.0.0 - Last updated : 2025-01-01 - Compatible platforms : Claude, ChatGPT, Gemini - authentication-setup - deployment