SECURITY.md

PBBGs are cheat targets. Assume every request is hostile.

Authentication

Hash with bcryptjs, cost 10–12. Never store or log plaintext.
Case-insensitive unique usernames (DB index uses COLLATE NOCASE).
Login errors are generic: INVALID_CREDENTIALS. Do a dummy hash compare when the user doesn't exist (timing).
Regenerate the session ID on login (req.session.regenerate) to prevent fixation.
Logout destroys the session server-side and clears the cookie.
Banned users (is_banned=1) are rejected at login and in requireAuth.

httpOnly: true, sameSite: 'lax', secure: true when NODE_ENV=production.
maxAge 7 days, rolling. Secret from SESSION_SECRET env (refuse to boot in production without it).
Store sessions in SQLite, not memory (so restarts don't log everyone out).

Cookie-based sessions + state-changing POSTs ⇒ CSRF matters.

sameSite=lax blocks most cross-site POSTs.
Additionally require header Content-Type: application/json on all POSTs and reject others (browsers can't send cross-site JSON without CORS preflight). Do not enable CORS.

Validate every body/query/param with zod. Reject unknown keys (.strict()).
Clamp numerics (quantities 1–99). Reject NaN/negative/float where ints are expected.
Never render user-supplied text with innerHTML. Use textContent. (Usernames and hero names are user-supplied!)

Server decides all outcomes; client sends only intent.
Every multi-step state change is one DB transaction (spend + grant).
Ownership: derive the character from the session — never accept characterId from the client.
Check inventory.character_id = ? on every inventory operation.
Spam: rate-limit actions (e.g., 30 game actions / minute / user) — energy is the real limit, this is a safety net.
Expedition claim: set claimed_at and grant rewards in one transaction; the partial unique index prevents duplicates.
Never trust client clocks. All timing from utils/time.now().

helmet() defaults. Provide a CSP: default-src 'self' (no inline scripts — put JS in files).
Serve behind HTTPS in production (note in README; reverse proxy is out of scope).
app.set('trust proxy', 1) only if running behind a proxy.

Public endpoints (/leaderboard, /heroes/:name) return only: name, class, level, kills, gold(optional). Never user ids, usernames, or emails.
Hero name ≠ login username (so leaderboard doesn't reveal login names).
Error handler returns generic message for unexpected errors; stack traces go to the server log only.

Prepared statements with ? / named params only. No string-built SQL, ever. Table/column names are never user-controlled (use allowlist for leaderboard sort type).