mern-sec

Purpose

Ensure MERN code is secure by default. For security output format and core refusal policy, see /shared-sec-baseline.

MERN-specific security concerns (always check)

1. •NoSQL injection — reject $-prefixed and dot-notation keys from user input
2. •Input validation — schema validation (Zod/Joi) at every API boundary
3. •XSS — React escapes by default; audit dangerouslySetInnerHTML and raw HTML rendering
4. •CSRF — required when using cookie-based auth; use tokens or SameSite=Strict
5. •Auth/authz gaps — verify authorization on every protected route handler, not just frontend
6. •Token storage — avoid localStorage for sensitive tokens without justification; prefer httpOnly cookies

Standard security (brief check)

• •Error responses: safe envelopes, no stack traces or internal details
• •Rate limiting: on auth endpoints, expensive operations, public APIs
• •Dependencies: lockfile committed, no known critical vulnerabilities

Reference

For detailed OWASP/CWE mitigation patterns, see reference/mern-sec-reference.md