Node.js with bcrypt

```javascript

const bcrypt = require('bcrypt');

// Hashing (on registration)

const saltRounds = 12;

const hashedPassword = await bcrypt.hash(plainPassword, saltRounds);

// Verification (on login)

const isValid = await bcrypt.compare(plainPassword, hashedPassword);

```

Python with bcrypt

```python

import bcrypt

# Hashing

hashed = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt(rounds=12))

# Verification

is_valid = bcrypt.checkpw(password.encode('utf-8'), hashed)

```

.env file (development only, never commit)

```bash

# .env

DATABASE_URL=postgresql://user:pass@localhost:5432/myapp

JWT_SECRET=your-256-bit-secret-here

API_KEY=sk_test_xxxxx

```

.gitignore (mandatory)

```gitignore

.env

.env.local

.env.*.local

*.pem

*.key

credentials.json

secrets/

```

Loading environment variables

```javascript

// Node.js with dotenv

require('dotenv').config();

const dbUrl = process.env.DATABASE_URL;

// Fail fast if missing

if (!process.env.JWT_SECRET) {

throw new Error('JWT_SECRET environment variable is required');

}

```

```sql

-- Enable RLS on table

ALTER TABLE documents ENABLE ROW LEVEL SECURITY;

-- Users can only read their own documents

CREATE POLICY "Users can read own documents" ON documents

FOR SELECT USING (auth.uid() = user_id);

-- Users can only insert documents as themselves

CREATE POLICY "Users can insert own documents" ON documents

FOR INSERT WITH CHECK (auth.uid() = user_id);

-- Users can only update their own documents

CREATE POLICY "Users can update own documents" ON documents

FOR UPDATE USING (auth.uid() = user_id);

-- Users can only delete their own documents

CREATE POLICY "Users can delete own documents" ON documents

FOR DELETE USING (auth.uid() = user_id);

```

Express.js

```javascript

const cors = require('cors');

// BAD: Allow all origins

app.use(cors());

// GOOD: Specific origins

app.use(cors({

origin: ['https://myapp.com', 'https://www.myapp.com'],

methods: ['GET', 'POST', 'PUT', 'DELETE'],

allowedHeaders: ['Content-Type', 'Authorization'],

credentials: true

}));

```

Express.js with Helmet

```javascript

const helmet = require('helmet');

app.use(helmet({

contentSecurityPolicy: {

directives: {

defaultSrc: ["'self'"],

scriptSrc: ["'self'"],

styleSrc: ["'self'", "'unsafe-inline'"],

imgSrc: ["'self'", "data:", "https:"],

},

},

hsts: {

maxAge: 31536000,

includeSubDomains: true,

preload: true

}

}));

```

Manual headers

```javascript

// Essential security headers

res.setHeader('X-Content-Type-Options', 'nosniff');

res.setHeader('X-Frame-Options', 'DENY');

res.setHeader('X-XSS-Protection', '1; mode=block');

res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');

res.setHeader('Content-Security-Policy', "default-src 'self'");

```

```javascript

// NEVER log these:

// - Passwords (plain or hashed)

// - Session tokens / JWTs

// - API keys

// - Credit card numbers

// - Social security numbers

// - Full request bodies with user data

// BAD

console.log('Login attempt:', { email, password });

console.log('Request:', req.body);

// GOOD

console.log('Login attempt:', { email, success: false, reason: 'invalid_password' });

console.log('Request:', { endpoint: req.path, method: req.method, userId: req.user?.id });

```

"I stored passwords in plain text"

1. Add password hashing immediately
2. Force password reset for all users
3. Invalidate all existing sessions
4. Check if database was ever exposed/leaked

"My API key is in the git history"

1. Rotate the key immediately (generate new one)
2. Revoke the old key
3. Use git filter-branch or BFG Repo-Cleaner to remove from history
4. Force push (coordinate with team)

"I don't know what data I'm logging"

1. Search codebase for console.log, logger., print(
2. Review what's being logged
3. Implement structured logging with field allowlists
4. Set up log rotation and retention

"My database is publicly accessible"

1. Change database credentials immediately
2. Configure firewall rules (allow only application server IPs)
3. Enable SSL/TLS for connections
4. Review access logs for unauthorized queries

You likely need to care about:

• GDPR (EU users): Data deletion rights, consent, breach notification
• CCPA (California users): Similar to GDPR
• PCI DSS (credit cards): Don't store card numbers, use payment processor
• HIPAA (health data): Encryption, access controls, audit logs
• SOC 2 (enterprise sales): Security controls documentation

Minimum for any user data:

1. Privacy policy explaining data collection
2. Way for users to request data deletion
3. Encryption in transit (HTTPS) and at rest
4. Access logs and audit trail
5. Incident response plan (even if basic)

• OWASP Top 10: https://owasp.org/www-project-top-ten/
• OWASP Cheat Sheets: https://cheatsheetseries.owasp.org/
• Have I Been Pwned (check for breaches): https://haveibeenpwned.com/
• Mozilla Observatory (test your headers): https://observatory.mozilla.org/
• SSL Labs (test your TLS): https://www.ssllabs.com/ssltest/