Sabitlenmiş Tweet
Run this before you ship anything built with AI :
SECURITY
✅ no rate limiting on any endpoint — bots will hit your API all night. $500 bill by morning.
✅ JWT stored in localStorage — one XSS attack = every user account compromised. use httpOnly cookies.
✅ sessions not invalidated server-side on logout — client-side cookie clear isn't enough. old token still works.
✅ hardcoded API keys in frontend JS — anyone who opens devtools can read them. cursor does this constantly.
✅ admin routes protected only in the frontend — hit the endpoint directly and it opens right up.
✅ CORS set to wildcard (*) — any website can make authenticated requests to your API.
DATABASE
✅ no connection pooling — first 50 concurrent users exhaust connections. everything crashes.
✅ no pagination on list endpoints — one query loads your entire users table into memory.
✅ DB migrations run automatically on startup — two instances deploy at once = race condition = corrupted data.
✅ no backup ever tested with a restore — you have backups. you've never actually restored from one.
RELIABILITY
✅ file uploads going to your app server — disk fills, server dies, files gone. use S3 from day one.
✅ emails sent synchronously in request handlers — slow SMTP = every triggered request hangs.
✅ no error alerting configured — app crashes at 3am. you find out when a user emails at 9am.
✅ no HTTPS enforcement — credentials intercepted on any public network.
✅ .env committed to git even once — it's in the history after you delete it. rotate every key.
Bookmark this. Use it every time.
English
