# 🔒 Security & Performance Review (09_devops_security)

## Security Architecture & Best Practices
1. **API Security & Auth Guards**:
   - NestJS JWT strategy validation with expiration and payload checking.
   - Strict `RolesGuard` protecting B2B wholesale routes (`User_Wholesale`) and Admin routes (`ADMIN`).
   - Rate limiting via NestJS `@nestjs/throttler` to prevent abuse.
   - CORS policy allowing configured origins only.
2. **Data Sanitization & Injection Prevention**:
   - NestJS global `ValidationPipe` preventing mass assignment and SQL injection via Prisma parameterized queries.
   - Password hashing using bcrypt.
3. **Performance & Caching**:
   - PostgreSQL indexing on frequent search fields (`categorySlug`, `suitableFor`, `artNo`, `slug`, `requiresRx`).
   - Next.js caching strategy (`revalidate` / fetch caching) for high-frequency dynamic routes.