bcrypt library used

Salt rounds = 12

Password min length 12

Password complexity

Access token expiry 15m

Refresh token expiry 7d

JWT payload type claim

Auth middleware type check

Account lockout threshold

Lockout duration 15min

Secrets from env vars

Security event logging

No sensitive data in errors

Helmet middleware used

CSP defaultSrc self

HSTS maxAge 31536000

HSTS includeSubDomains

Auth rate limit max 5

Auth rate limit window 15min

skipSuccessfulRequests true

API rate limit max 100

standardHeaders true

legacyHeaders false

CORS credentials true

CORS maxAge 86400

Cookie sameSite strict

Cookie httpOnly secure

Zod library used

Email max length 255

Name field constraints

Parameterized queries

path.basename sanitization

path.resolve boundary check

execFile not exec

URL protocol check

URL host allowlist

File type allowlist

File size limit

Magic bytes verification

DOMPurify imported

DOMPurify ALLOWED_TAGS

CSRF middleware used

CSRF token in form/header

Cookie SameSite strict

Cookie httpOnly and secure

Helmet CSP defaultSrc self

Helmet CSP scriptSrc self

No innerHTML with raw user content

Payload size limit

Security event logging

requireRole middleware

Server-side ownership check

403 for unauthorized access

Vertical escalation blocked

Horizontal escalation blocked

Privilege escalation logged

Failed auth events logged

JWT algorithm allowlisted

Secrets from env vars

Generic auth error messages

AES-256-GCM used

Random IV per encryption

No weak algorithms

Encryption key from env

HTTPS redirect middleware

Security considerations documented

Config requirements documented

Testing recommendations documented

No sensitive data in errors

Security event logging

Helmet security headers