production-security

Production Security Patterns

Metadata:

• Status: ✅ Active
• Always Apply: true
• Topics: #security #production #scale
• Last Updated: 2025-10-07

🔍 Code Searchability Patterns

Find security-patterns Issues with ast-grep

# Find parseFloat($$$)
# Find env.$DB.prepare(`SELECT $QUERY`)
# Find new Date()
# Find WASM.*exports
ast-grep --pattern 'parseFloat($$$)' src/
ast-grep --pattern 'env.$DB.prepare(`SELECT $QUERY`)' src/
ast-grep --pattern 'new Date()' src/
ast-grep --pattern 'WASM.*exports' src/
sg -p 'parseFloat($$$)' src/
sg -p 'env.$DB.prepare(`SELECT' src/
sg -p 'new' src/
sg -p 'WASM.*exports' src/

security-patterns Discovery Commands

sg search "parseFloat" src/
sg search "SELECT" src/
sg search "new Date()" src/
sg search "WASM" src/

Search Examples

# Find parseFloat usage (security risk)
sg search 'parseFloat($$$)' src/
# Find SQL injection risks
sg search 'env.$DB.prepare(`SELECT' src/
# Find timezone issues
sg search 'new' src/
# Find WASM memory leaks
sg search 'WASM.*exports' src/

Overview

This rule enforces production-ready security patterns for sports betting platforms handling real money at scale.

All patterns are enforced via ast-grep rules in the rules/ directory.

Critical Security Rules

1. No parseFloat on Stakes (CRITICAL)

Rule: rules/no-parsefloat-stake.yaml

Why: parseFloat("100abc") returns 100, accepting garbage input. For betting stakes, this is catastrophic.

// ❌ DANGEROUS
const stake = parseFloat(userInput);  // Accepts "100abc" → 100

// ✅ SAFE
const stake = Number(userInput);
if (isNaN(stake) || stake <= 0) {
  throw Errors.validationError('Invalid stake amount');
}

Enforcement:

sg scan --filter "no-parsefloat-stake" --error

2. D1 SQL Injection Prevention (CRITICAL)

Rule: rules/d1-sql-injection.yaml

Why: Template literal interpolation bypasses D1's parameterization.

// ❌ SQL INJECTION RISK
const userId = request.query.id;
await env.ANALYTICS.prepare(`SELECT * FROM users WHERE id = '${userId}'`).all();

// ✅ PARAMETERIZED QUERY
await env.ANALYTICS.prepare(`SELECT * FROM users WHERE id = ?`)
  .bind(userId)
  .all();