paqad-ai
Version:
Spec-driven development framework — AI agents that think before they type
8 lines (6 loc) • 507 B
Markdown
# Svelte Security Review Checklist
- Validate SvelteKit server route authentication and `handle` hook for protected paths.
- Check for unsafe `{@html ...}` usage that could introduce XSS via unsanitized data.
- Review environment variable handling: `$env/static/private` must never be imported in client-side modules.
- Confirm form actions use CSRF protection and input validation before processing mutations.
- Check for sensitive data exposure in publicly accessible `+page.server.ts` `load` functions.