The Security Pass

More projects are compromised by a committed API key than by anything clever. It happens because the fastest working version puts the key in the code.

const stripe = new Stripe("sk_live_51H8xK2...");

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);

1. 1
   Keep .env in .gitignore

   Check this before your first commit, not after.

2. 2
   Commit a .env.example instead

   Variable names with empty values, so collaborators know what is needed.

3. 3
   Remember that git never forgets

   A key committed and then deleted is still in the history. Rotate it — deleting the line is not enough.

Generated code assumes input is well-formed, because in the happy path it is. Two consequences dominate.

Injection. Anywhere user text gets concatenated into a query, a command, or HTML:

db.query("SELECT * FROM users WHERE email = '" + email + "'");

db.query("SELECT * FROM users WHERE email = $1", [email]);

Validation on the server. Client-side checks are a convenience for honest users, not a control. Anyone can call your endpoint directly, and the AI will rarely add server-side validation unless you ask.

This is the subtle one, and the one that produces real breaches. The model reliably checks that someone is logged in. It frequently forgets to check that they are allowed to touch this particular record.

const order = await db.orders.findById(params.id);return Response.json(order);

const order = await db.orders.findById(params.id);if (order.userId !== session.user.id) {  return new Response("Not found", { status: 404 });}return Response.json(order);

Change the id in the URL and see what happens. That single test finds this class of bug faster than reading ever will.

Ask for a security review as a separate pass, in a fresh conversation. Asking the same thread that wrote the code tends to produce agreement with itself.

Review this code for security problems. Check specifically: - secrets or credentials in source- unvalidated user input reaching a query, command, or the DOM- endpoints that check authentication but not ownership- errors that leak stack traces or internal details to users- anything that trusts data from the client For each issue: what an attacker does, and the fix.If you find nothing in a category, say so explicitly.