advanced
OWASP, secrets, and dependency scanning
Use OWASP risks as a review checklist while keeping secrets out of code/logs and triaging dependency vulnerabilities by exploitability and reachability.
OWASP Top 10 is a risk checklist — broken access control and injection remain perennial leaders. Use it to structure reviews, not as a compliance checkbox.
Secrets belong in environment variables, secret managers (Vault, cloud SM), or runtime injection — never in git, client bundles, or INFO logs. Scan repos with gitleaks/trufflehog in CI; rotate on exposure.
npm audit --production
# Pair with lockfile, SBOM, and reachability analysis — not audit alone
Dependency scanning triages CVEs by reachability: is the vulnerable function called on an attacker-influenced path? Patch or pin; document accepted risk with expiry.
On interviews: secret rotation without downtime; supply-chain attacks via compromised packages; pinning vs ranges in libraries you ship.
Common pitfalls: `.env` committed once forever in history; ignoring devDependency CVEs in build pipelines; npm audit fix breaking semver blindly.
The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.
Checklist:
- Secret manager + rotation runbooks.
- CI secret scan and dependency policy gates.
- Triage CVEs by exploitability and exposure.
- Minimal dependency footprint and lockfile discipline.