Purpose
Ensure MERN code is secure by default. For security output format and core refusal policy, see /shared-sec-baseline.
MERN-specific security concerns (always check)
- NoSQL injection — reject
$-prefixed and dot-notation keys from user input - Input validation — schema validation (Zod/Joi) at every API boundary
- XSS — React escapes by default; audit
dangerouslySetInnerHTMLand raw HTML rendering - CSRF — required when using cookie-based auth; use tokens
[Description truncada. Veja o README completo no GitHub.]