FastAPI Security Checklist

Use Pydantic models for all request validation. FastAPI automatically validates requests against Pydantic schemas, but ensure all fields are properly typed.

Use SQLAlchemy ORM or parameterized queries with your database driver. Never use f-strings or string formatting in SQL queries.

Implement OAuth2 with JWT using FastAPI's built-in `OAuth2PasswordBearer` and proper token validation with `python-jose`.

Configure CORS middleware explicitly. Use `CORSMiddleware` with specific `allow_origins` rather than wildcards in production.

Use `python-dotenv` for environment variables and never hardcode secrets. Keep `.env` files out of version control.

Implement rate limiting using `slowapi` or a reverse proxy. FastAPI does not include built-in rate limiting.

Use `UploadFile` type for file uploads with validation of content type and file size. Process files securely.

Avoid using `pickle.loads()` or `yaml.load()` on untrusted data. Use `json.loads()` for deserialization of user input.