Always check for and prevent:
- SQL injection - use parameterized queries only
- XSS - escape all user input in HTML output
- CSRF - use tokens for state-changing requests
- Hardcoded secrets - use environment variables
- Insecure dependencies - check npm audit / pip audit
- Missing input validation - validate all user inputs
- Improper error exposure - don't leak stack traces
- Missing authentication - verify auth on all protected routes
- Broken access control - check authorization for every action
- Sensitive data exposure - encrypt at rest and in transit