$ security --review --scope=every-delivery
Security
Not a separate service I sell on top — it's part of how I build. Every project I ship gets a security pass before delivery. Here's what that actually covers, and where it's shown up in practice.
// Checked, every time
Authentication & access control
Proper session/token handling, least-privilege access, no default credentials left behind.
Secrets management
API keys and credentials in env vars or a secrets manager — never committed to the repo.
Input validation
Guarding against injection (SQL, XSS, command) at every boundary where user input enters the system.
Dependency hygiene
Regular audits (npm audit or equivalent), dependencies kept current, known CVEs tracked.
Transport & headers
HTTPS enforced, secure headers set, CORS scoped to what's actually needed.
Rate limiting & abuse protection
Public endpoints protected against brute-force and basic abuse patterns.
// From recent deliveries
No project write-ups yet — add security notes from the portfolio admin.