Security Best Practices

// Securely store API keys
// 1. Using environment variables
const apiKey = process.env.API_KEY;

// 2. Using key management service
import { SecretManagerServiceClient } from '@google-cloud/secret-manager';
const client = new SecretManagerServiceClient();
const [secret] = await client.accessSecretVersion({
  name: 'projects/PROJECT_ID/secrets/api-key/versions/latest',
});

// 3. Input validation and sanitization
function sanitizeInput(input) {
  // Remove potential injection attacks
  return input.replace(/<script[^>]*>.*?</script>/gi, '')
              .replace(/[<>]/g, '')
              .trim();
}

// 4. Implement rate limiting
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100 // Limit to 100 requests
});

app.use('/api/', limiter);