vf-security-checklist

Veryfront Security Checklist

Overview

Veryfront has undergone a comprehensive security audit. This checklist captures the verified patterns and known pitfalls.

Core principle: Validate at boundaries, use framework security utilities, never trust client input.

Before You Ship: Quick Check

Run through these when modifying security-sensitive code:

Input & Validation

• User input validated with Zod schemas before use
• Path inputs validated with validatePathSync() from #veryfront/security
• No string concatenation for SQL/commands — use parameterized queries / array args
• HTML user content escaped or wrapped with validateTrustedHtml()

Authentication & Tokens

• JWT signatures verified (not just payload extraction)
• Tokens in headers or cookies (never in URL query params)
• WebSocket auth uses subprotocol header, not query string
• Session tokens stored securely (compliance-approved method)

Network & Routing

• Redirects validate URL scheme (block javascript:, data:, vbscript:)
• CORS origins explicitly listed (no wildcard * in production)
• Rate limiting uses trustProxy: false (default) unless behind a trusted reverse proxy
• WebSocket enforces wss:// in production (not plain ws://)

File System

• File paths validated against traversal (../) attacks
• Use SecureFS methods for file operations
• SecureFS unsafe methods (unsafeReadFile, etc.) not used in production paths
• Upload handlers have auth middleware
• Sandbox code execution has size/time limits

Commands

• External commands use array arguments (no shell interpolation)
• No shell: true option in subprocess calls
• User input never concatenated into command strings

Security Module Utilities

import {
  validatePathSync,
  validateTrustedHtml,
  // Rate limiting, CORS, input validation
} from "#veryfront/security";

// Path validation — prevents traversal
const safePath = validatePathSync(userInput, { baseDir: projectRoot });

// HTML safety — wraps trusted HTML
const html = validateTrustedHtml(content);