API Security Cheatsheet

const Input = z.object({
  email: z.string().email(),
  limit: z.coerce.number().int().min(1).max(100),
}).strict();

db.query('SELECT * FROM users WHERE id = $1', [userId]);

const invoice = await loadInvoice(id);
if (invoice.tenantId !== user.tenantId) throw forbidden();

key: user ID, API key, and/or trusted IP
limit by endpoint cost
return 429 + Retry-After
protect login and recovery separately

Strict-Transport-Security: max-age=31536000
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer

allow-list schemes and hosts
resolve and reject private IP ranges
disable unsafe redirects
set timeouts and size limits

do not log tokens, passwords, card data, or health data
redact structured fields
encrypt in transit and at rest
minimize retention

dependency scanning
secret scanning
key rotation
audit logs
incident playbook
regular access review