canina/.ai_agency/specs/reviews/security_review.md

🔒 Security & Performance Review (09_devops_security)

Security Architecture & Best Practices

1. API Security & Auth Guards:
   • NestJS JWT strategy validation with expiration and payload checking.
   • Strict RolesGuard protecting B2B wholesale routes (User_Wholesale) and Admin routes (ADMIN).
   • Rate limiting via NestJS @nestjs/throttler to prevent abuse.
   • CORS policy allowing configured origins only.
2. Data Sanitization & Injection Prevention:
   • NestJS global ValidationPipe preventing mass assignment and SQL injection via Prisma parameterized queries.
   • Password hashing using bcrypt.
3. Performance & Caching:
   • PostgreSQL indexing on frequent search fields (categorySlug, suitableFor, artNo, slug, requiresRx).
   • Next.js caching strategy (revalidate / fetch caching) for high-frequency dynamic routes.