What is SQL Injection?
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.
Related terms
OWASP Top 10
The community-ranked list of the most critical web application risks, refreshed every few years from real breach data. Teams use it to prioritize injection, broken auth, and misconfiguration fixes first.
Dependency Scanning
Automated auditing of third-party packages against vulnerability databases before and after deployment. Lockfiles, advisories, and CI gates turn newly disclosed CVEs into upgrade tasks instead of surprises.
Row-Level Security (RLS)
Per-user table policies enforced by the database itself: users can only read or write their own rows. RLS is what makes the anon key safe to ship in client code.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
CSP Directives
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.
HTTP Strict Transport Security (HSTS)
A response header that obliges browsers to use HTTPS only for a domain, blocking protocol-downgrade attacks. BYOB’s Traefik edge already redirects port 80 to 443, and HSTS pins that behavior client-side.