# Security Best Practices — Fastify

Source: https://www.geekswithgeeks.com/en/fastify/ff-security

> Secure your Fastify application against common vulnerabilities.

## Common threats and defenses

Protect against: SQL injection (parameterized queries), XSS (JSON response), CSRF (tokens), brute-force (rate limiting), and exposure of secrets.

## Security headers

Use the @fastify/helmet plugin to set protective HTTP headers.

```javascript
import helmet from '@fastify/helmet';

await fastify.register(helmet, {
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'"],
    },
  },
});

// Sets headers: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, etc.
```

## Secrets management

Never hardcode secrets. Use environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault).