The original title is "A Production Security Checklist" which is vague. I need to make it more specific based on the summary.

Short summary

A practical production security checklist for multi-tenant SaaS apps covering authentication, authorization, and tenant isolation. Key recommendations include using httpOnly cookies instead of localStorage for JWTs, rotating refresh tokens with token family detection, and enforcing tenant scoping at the data layer via Postgres row-level security. The author emphasizes that the most damaging bugs are usually missing tenant filters on queries, not missing role checks.

• •Use httpOnly cookies for session tokens, not localStorage — XSS vulnerabilities expose all sessions otherwise
• •Derive tenant IDs from authenticated sessions, never from client input; enforce scoping at the data layer with Postgres RLS
• •Rotate refresh tokens with token family detection to catch token theft; hash passwords with bcrypt or argon2

Generated with AI, which can make mistakes.