OWASP Top 10 quick reference

Workflow

Step 1: Define a validation layer with Zod

Every external input must pass through a schema before touching business logic.

```typescript import { z } from "zod";

export const CreateUserSchema = z.object({ email: z .string() .email("Invalid email format") .max(254, "Email too long") .transform((v) => v.toLowerCase().trim()), password: z .string() .min(12, "Password must be at least 12 characters") .max(128, "Password too long") .regex( /^(?=.[a-z])(?=.[A-Z])(?=.\d)(?=.[^a-zA-Z\d])/, "Password must include upper, lower, digit, and special character" ), displayName: z .string() .min(1) .max(64) .regex(/^[\w\s-]+$/, "Display name contains invalid characters"), });

export type CreateUserInput = z.infer<typeof CreateUserSchema>;

export function validateInput<T>( schema: z.ZodSchema<T>, data: unknown ): { success: true; data: T } | { success: false; errors: z.ZodError } { const result = schema.safeParse(data); if (result.success) return { success: true, data: result.data }; return { success: false, errors: result.error }; } ```

Step 2: Harden HTTP headers

```typescript import { NextResponse } from "next/server"; import type { NextRequest } from "next/server";

const SECURITY_HEADERS: Record<string, string> = { "Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Referrer-Policy": "strict-origin-when-cross-origin", "Permissions-Policy": "camera=(), microphone=(), geolocation=()", "Content-Security-Policy": [ "default-src 'self'", "script-src 'self' 'unsafe-inline'", "style-src 'self' 'unsafe-inline'", "img-src 'self' data: https:", "connect-src 'self' https:", "font-src 'self'", "frame-ancestors 'none'", ].join("; "), };

export function applySecurityHeaders( request: NextRequest, response: NextResponse ): NextResponse { for (const [key, value] of Object.entries(SECURITY_HEADERS)) { response.headers.set(key, value); } return response; } ```

Step 3: Sanitize output encoding

```typescript const HTML_ESCAPE_MAP: Record<string, string> = { "&": "&", "<": "<", ">": ">", '"': """, "'": "'", "/": "/", };

export function escapeHtml(str: string): string { return str.replace(/[&<>"'/]/g, (ch) => HTML_ESCAPE_MAP[ch] ?? ch); }

export function escapeForAttribute(str: string): string { return str.replace(/[&<>"']/g, (ch) => HTML_ESCAPE_MAP[ch] ?? ch); }

export function escapeForUrl(str: string): string { return encodeURIComponent(str); } ```

Step 4: Enforce parameterized queries

```typescript import { getServerSupabase } from "@/lib/db/client";

export async function getUserByEmail(email: string) { const db = getServerSupabase(); const { data, error } = await db .from("users") .select("id, email, display_name, role") .eq("email", email.toLowerCase().trim()) .maybeSingle(); if (error) throw new Error("Query failed"); return data; } ```

Never interpolate user input into SQL strings. Always use parameterized queries or the Supabase query builder.

Step 5: Dependency scanning

```bash

Audit dependencies for known vulnerabilities

pnpm audit --audit-level=high

Pin exact versions in lock file

pnpm install --frozen-lockfile

Check for outdated packages

pnpm outdated ```

Add `pnpm audit` to CI and fail the build on high-severity findings.

Examples

Example 1: API route with full validation

```typescript import { NextResponse } from "next/server"; import { CreateUserSchema, validateInput } from "@/lib/validation"; import { createUser } from "@/lib/db/users"; import { rateLimit } from "@/lib/rate-limit";

export async function POST(request: Request) { const limited = await rateLimit(request, { max: 5, windowMs: 60_000 }); if (limited) { return NextResponse.json( { error: "Too many requests" }, { status: 429 } ); }

const body = await request.json().catch(() => null); if (!body) { return NextResponse.json({ error: "Invalid JSON" }, { status: 400 }); }

const validation = validateInput(CreateUserSchema, body); if (!validation.success) { return NextResponse.json( { error: "Validation failed", details: validation.errors.flatten() }, { status: 422 } ); }

const user = await createUser(validation.data); return NextResponse.json({ id: user.id }, { status: 201 }); } ```

Example 2: Supabase Row-Level Security policy

```sql -- Users can only read their own data CREATE POLICY "users_read_own" ON public.profiles FOR SELECT USING (auth.uid() = user_id);

-- Users can only update their own profile CREATE POLICY "users_update_own" ON public.profiles FOR UPDATE USING (auth.uid() = user_id) WITH CHECK (auth.uid() = user_id);

-- Admins can read all profiles CREATE POLICY "admins_read_all" ON public.profiles FOR SELECT USING ( EXISTS ( SELECT 1 FROM public.user_roles WHERE user_roles.user_id = auth.uid() AND user_roles.role = 'admin' ) ); ```

Decision tree

• User input arrives → validate with Zod schema before any processing
• Rendering user content → apply context-appropriate output encoding
• Storing passwords → use bcrypt (cost 12+) or argon2id
• Accessing data → enforce row-level security + server-side auth checks
• Third-party dependency → pin version, check audit, review changelog
• Sensitive config → environment variable, never committed to repo
• If unsure about a pattern → apply the strictest control and relax intentionally

Edge cases and gotchas

1. Double encoding — encoding output that was already encoded produces garbled text. Track encoding state through the pipeline.
2. Zod transforms silently change data — `.transform()` runs after validation. Log the pre/post values during development to catch surprises.
3. CSP breaking inline scripts — strict CSP blocks inline handlers and eval. Use nonces or move scripts to external files.
4. Rate limiter bypass via IP spoofing — `X-Forwarded-For` is trivially spoofed. Use Vercel's trusted `x-real-ip` or Cloudflare's `CF-Connecting-IP`.
5. Lock file drift — `pnpm install` without `--frozen-lockfile` in CI can pull unaudited versions. Always freeze in CI.
6. RLS not enabled — Supabase tables have no RLS by default. Every table with user data must have explicit policies; use `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`.
7. JWT expiry mismatch — short-lived access tokens with long-lived refresh tokens need separate validation paths.

Evaluation criteria

• All user input validated with typed Zod schemas before processing
• No raw SQL string interpolation anywhere in the codebase
• Security headers applied to all responses (HSTS, CSP, X-Content-Type-Options)
• Passwords hashed with bcrypt (cost ≥ 12) or argon2id
• RLS enabled on every Supabase table containing user data
• Dependency audit passes with no high/critical findings
• Rate limiting applied to authentication and write endpoints
• Secrets stored in environment variables, not in code or config files
• Error responses do not leak stack traces, SQL errors, or internal paths
• Security logging captures auth failures, permission denials, and validation errors

Research-backed changes

The biggest delta is Sign in. Fold the concrete changes into the operating notes, then discard the fluff.

Fresh signals

• Sign in · GitHub Security Advisories
• Sign up · GitHub Security Advisories
• @tinacms/graphql's FilesystemBridge Path Validation Can Be Bypassed via Symlinks or Junctions · GitHub Security Advisories
• Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value · GitHub Security Advisories

Next edits

• Add one new tactic based on Sign in.
• Rewrite one stale section with today's source language.
• Turn the top signal into a reusable agent prompt.