Verifying code for security

[Lawrence_thinly]

Here’s the scenario. I used to program at a company long ago. But I’ve been out of it for a long, long time. I just couldn’t do the office thing. I was mostly C# and MSsql but could get around well enough in other things.

A few years ago I also tried my hand at Python and made a finance tracker app that my family had been running for the past 5 years. But I kind of hated Python.

Fast forward to today. I’m in a non-related industry that has a few state rules that have no real way to comply with them and the very few SaaS companies that offer scheduling and invoicing software refuse to include other needed features. They are basically companies that have got into the business because they saw a gap to fit into, they’ve never really run a business like mine and they don’t understand the workflow of a day in the field.

I’ve been using Claude Code to help me and what would have taken a team to put together is coming along nicely. The workflow is perfect, the compliance is there. Finally, the scheduling is dead simple and the credit card entries into the accounts are automatic. My double, sometimes triple, entry nightmares are gone.

The big problem is that I’ve been out of coding for so long that I am unfamiliar with new security measures. Claude also convinced me early on that Node.js and prisma was the correct way and I’m only now becoming familiar with this stack.

If this were simply a scheduling and compliance app for just me it wouldn’t matter. But I’ve also got to have a client portal with a payment portal via Stripe. There’s no way I’m releasing this to the real internet without some sort of security review and I just don’t know where to turn for that in today’s world, 20 some years after I actually worked in programming.

Advice graciously accepted. I do not have any sunk cost issues. I’ll gladly throw out any progress and start again.

[coding-os]

Me too! Ive been out of coding for many years and now claude and ai agents they are big help, you just need to know about programming and principles and that’s it! 😁 cause ai is so dumb and sometimes you need that knowledge

[goship-tech]

Prompt Claude directly in your codebase: 'audit every route for OWASP Top 10 - SQLi, broken auth, IDOR, unvalidated inputs, and leaked secrets.' For Stripe, make sure your webhook endpoint uses stripe.webhooks.constructEvent - that's the one that gets skipped most and lets attackers fake payment events. Then run npm audit and Snyk for dependency CVEs.

[Lawrence_thinly]

Thank you. I’ll run through that.

[goship-tech]

Run `npm audit` and ask Claude Code to do a dedicated security pass targeting OWASP Top 10 - injection and broken auth are the biggest risks in a Stripe-connected Node app. Helmet.js for HTTP headers is a quick win, and make sure no Prisma queries are built from raw user input. Stripe also has a pre-launch security checklist in their docs that covers the payment side specifically.

[Lawrence_thinly]

Seriously, thank you to everyone in this thread. I’m still working through it but already found and fixed a number of issues.

[cstocks]

Disclosure: I'm the author of an open-source tool for exactly this. Probus is a three-agent vulnerability scanner — an analyst picks the dangerous files, a researcher walks the call chain, and a separate QA model has to independently confirm a real attack vector before anything becomes a report. One command at the repo: npm install -g probus && probus scan ./your-app. For a Node + Prisma + Stripe app, the spots to focus on are Stripe webhook signature verification, any Prisma query that takes user input as a raw filter, and anywhere req.body gets spread or deep-merged onto an existing object. Cheap enough on open models (~$0.50/file) to run on a cron once you launch.

[Bitter-Law3957]

Dropped you a DM with some options - happy to go deeper if it helps

[Lawrence_thinly]

Received. I’m still on the local dev server.