secure-code-review（安全代码审查）

Secure Code Review Checklist

Input Validation:

• Never trust user-supplied input; validate type, length, and format at boundaries.
• Use parameterized queries — never string-interpolate SQL.
• Sanitize before rendering HTML to prevent XSS.

Secrets & Credentials:

• No hardcoded passwords, API keys, or tokens in source code.
• Use environment variables or a secrets manager.
• Check .gitignore before adding any config files.

Dependencies:

• Pin dependency versions; audit with pip audit or npm audit.
• Minimize surface area: remove unused packages.

Auth:

• Verify authorization on every protected endpoint, not just at login.
• Use short-lived tokens; implement refresh flows.