Authentication
Passwords are hashed with bcrypt and authenticated requests use JWTs.
Security
Security is a system, not a color palette.
NexGen is being built with practical application security controls across authentication, API access, data handling, and deployment.
Current implementation
JWT authentication · bcrypt password hashing · Helmet · rate limiting · parameterized SQL · Stripe signature verification support
JWT authentication · bcrypt password hashing · Helmet · rate limiting · parameterized SQL · Stripe signature verification support
Current controls
Foundations already present in the codebase.
Data access
Database queries use parameters and user-owned resources are checked in the backend controllers.
Abuse protection
Authentication and contact routes include rate limiting, while Helmet provides baseline HTTP security headers.
Still required
Production security needs verification.
A production release still needs dynamic authorization tests, file-upload abuse tests, AI prompt-injection tests, dependency review, backup verification, monitoring, and a wired Stripe webhook flow.