secure-codinglisted

# Secure Coding (JS / Node.js / HTML / CSS) Apply automatically when writing any web code — hardened by default. Validate deployment topology (reverse proxy, TLS termination, CDN) before applying `trust proxy`, HSTS `preload`, or cross-origin isolation defaults. AI-generated code has 2.74x more vulnerabilities than human-written; 45% of AI samples introduce an OWASP Top 10 vuln (Veracode, 100+ LLMs). ## Workflow **New code:** secure defaults first (helmet, cors explicit origins, rate-limit, body size limit) → per endpoint: auth middleware → zod validation → parameterized queries → generic errors → scan against "Never Do" table. **Dependencies (prefer `context7` MCP; else npm registry / GitHub / GHSA):** latest stable version, no open critical/high CVEs, maintainer disqualify only on: deprecated, archived, unanswered CVE > 90 days, ownership transferred to unknown party (mature libs like `argon2`/`helmet`/`jose` sit quiet for months and stay canonical). Apps: `package-lock.json` + `npm ci`; libs: semver ranges + audit in CI. Prefer Safe Library Stack below. **Auditing existing code:** entry point → routes → middleware chain → static serving → `npm audit` + pinned versions + known compromised packages → configs (NODE_ENV, exposed .env/.git/source maps, debug endpoints) → per route: auth → validation → data handling → errors → headers/CSP/CORS/cookies/ports → report. **Audit output format:** ``` ### [CRITICAL/HIGH/MEDIUM/LOW] Finding title - **Location**: file:line - **Vul