• JWT (HS256, 24h)
• Bcrypt (10 rounds)
• Rôles: Manager/Employé

• SQL injection: Parameterized queries
• XSS: Suppression <>
• Email: RFC validation

• PostgreSQL 16
• Parameterized queries
• Connection pooling

• Helmet activé
• CORS configuré

Obligatoire:

# Générer JWT secret (64+ chars)
node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"

# .env
JWT_SECRET=<generated-secret>
NODE_ENV=production
DB_PASSWORD=<strong-password>
ALLOWED_ORIGINS=https://yourdomain.com

Recommandé:

• SSL/TLS (HTTPS)
• Firewall
• Monitoring
• Backups DB
• Mots de passe 12+ chars

# Vulnérabilités
npm audit

# Headers
curl -I http://localhost/api/health