# Security & Least Privilege Reference

Examples of common vulnerabilities and their remediations.

## 💉 Injection Prevention

```typescript
// BAD: Input concatenated directly into query
const query = `SELECT * FROM users WHERE id = ${userInput}`;

// GOOD: Use Parameterized Queries / Placeholders
const query = 'SELECT * FROM users WHERE id = ?';
const results = await db.execute(query, [userInput]);
```

## 🔐 Least Privilege

- **API Keys**: Don't use a global admin token for a read-only script. Create a scoped token with `read:users` only.
- **File System**: Ensure the application user only has write access to a specific `/uploads` directory, not the entire root.

## 🛡 Zero Trust

- **Authentication**: Never assume a request is safe because it comes from an internal microservice. **Always validate JWTs/Tokens at every entry point.**
