Veap packages provide application capabilities, not an automatic security boundary. The host application must enforce authorization, input validation, secret management, rate limiting, and operational controls.
Server-only boundaries#
- Keep database connections, auth services, mail transports, settings persistence, storage providers, and secret-bearing config in server-only modules.
- Use explicit client subpaths only for client features.
- Never serialize secret-bearing service instances or raw session tokens into React props.
Authentication#
- Enforce authorization on every privileged server operation, not only in navigation.
- Rate-limit login, signup, reset, verification, and recovery endpoints.
- Use secure cookie attributes and HTTPS.
- Avoid account enumeration in recovery flows.
- Do not log passwords, tokens, recovery codes, or sensitive form payloads.
Database#
- Validate request data and use mass-assignment restrictions.
- Bind query values; allow-list identifiers used in dynamic queries.
- Use transactions for multi-step writes.
- Add foreign keys, unique constraints, and indexes for invariants.
- Restrict database credentials to the minimum required privileges.
Uploads#
- Validate file size, content type, extension, and file contents.
- Keep private uploads outside the public document root.
- Authorize reads and deletes independently of the storage URL.
- Sanitize paths and filenames and test path traversal cases.
Plugins#
Plugins execute application code and must be trusted. Review dependencies, migration effects, lifecycle hooks, route handlers, event listeners, and UI extensions. Metadata-based visibility is not access control.
Configuration and logs#
Store secrets in a secret manager or deployment environment. Validate required values at startup. Redact credentials and personally sensitive data from logs and error responses.
