No string interpolation in SQL

No $queryRawUnsafe

No $queryRaw for ORM-expressible queries

ORM contains/like for text search

ORM where clause for filtering

Parameterized raw queries

Numeric ID parsed and validated

No raw flag / text() for ORM-expressible

Content-Type checked first

415 status on wrong Content-Type

Strings trimmed

Required fields validated

Length limits enforced

Numeric field parsed

NaN and range rejected

Enum validated against allowed list

Validated data passed to service

Service layer business rule

Mass assignment prevented

Backend returns JSON

No innerHTML with user data

textContent or DOM API used

No dangerouslySetInnerHTML

escapeHtml covers ampersand

escapeHtml covers angle brackets

escapeHtml covers double quote

escapeHtml covers single quote

Content-Type on POST endpoints

No server-side HTML interpolation

URL parsed before use

HTTPS-only enforced

Hostname allowlist checked

Invalid URL returns 400

Disallowed host returns 400

No req.body spread to DB

Explicit field destructuring

Content-Type checked

String fields trimmed

Required fields validated

Base directory resolved

Joined path resolved

startsWith containment check

400 on path traversal attempt

No exec() with user input

execFile or spawn used

User input as argument, not shell string

Numeric dimensions validated