# Check for vulnerabilities
npm audit

# Auto-fix what's possible
npm audit fix

# Force fix (may break things)
npm audit fix --force

# Generate report
npm audit --json > audit-report.json

# Test for vulnerabilities
snyk test

# Monitor project
snyk monitor

# Scan for secrets in git history
git secrets --scan

# Install hooks
git secrets --install

# Search for hardcoded secrets
grep -rn "password\|secret\|api_key\|apikey\|token" --include="*.js" --include="*.ts" .

# Check for exposed .env files
find . -name ".env*" -not -path "./node_modules/*"

# Check security headers
curl -I https://smarter.poker | grep -iE "(strict-transport|x-frame|x-content|content-security|x-xss)"

// helmet.js for Express
const helmet = require('helmet');
app.use(helmet());

// Next.js headers
module.exports = {
  async headers() {
    return [{
      source: '/:path*',
      headers: [
        { key: 'X-Frame-Options', value: 'DENY' },
        { key: 'X-Content-Type-Options', value: 'nosniff' },
        { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' }
      ]
    }];
  }
};

// NEVER do this
const query = `SELECT * FROM users WHERE id = ${userId}`;

// ALWAYS use parameterized queries (Supabase does this automatically)
const { data } = await supabase
  .from('users')
  .select('*')
  .eq('id', userId);

// Sanitize user input
import DOMPurify from 'dompurify';
const cleanHTML = DOMPurify.sanitize(dirtyHTML);

// React auto-escapes, but avoid dangerouslySetInnerHTML

# Check .gitignore includes sensitive files
grep -E "\.env|\.pem|\.key" .gitignore

# Verify no secrets in git history
git log -p | grep -iE "(password|secret|api_key)" | head -20