afu-it/security-for-vibecoders/secure-ship

[ ] All DB queries use parameterized bindings (no string concatenation)
[ ] All protected routes enforce authentication and authorization
[ ] All tenant-owned queries are scoped by tenantId/userId
[ ] IDOR tests cover cross-tenant access attempts
[ ] All user input validated with schema (Zod/Joi/Pydantic)
[ ] No hardcoded secrets in source code
[ ] .env files are gitignored, .env.example committed
[ ] Passwords hashed with Argon2id or bcrypt (cost 12+)
[ ] Auth enforced on all protected routes
[ ] Login rate-limited (brute-force protection)
[ ] JWTs expire in 15 minutes, refresh tokens in httpOnly cookies
[ ] CORS whitelist specific origins (no wildcard with credentials)
[ ] PII fields encrypted at rest (AES-256-GCM)
[ ] Security headers configured (CSP, HSTS, X-Frame-Options)
[ ] Error responses don't leak stack traces or SQL queries
[ ] Payment webhooks have idempotency guards
[ ] Webhook tokens use timing-safe comparison
[ ] Structured audit logs on sensitive operations
[ ] Tests exist and run in CI before deploy
[ ] npm audit / dependency scanning in CI
[ ] SAST (CodeQL/Semgrep) in CI
[ ] Secret scanning (Gitleaks) in CI
[ ] Lockfile committed and verified with npm ci
[ ] No typosquatted or suspicious dependencies
[ ] Rate limiting on authenticated endpoints
[ ] File uploads validate magic bytes, not just extension
[ ] No user input passed to shell commands or eval()
[ ] No raw server-side fetch of user-provided URLs
[ ] SSRF controls block private, loopback, link-local, and metadata IPs
[ ] License file exists, no GPL violations