Nuxt Security Checklist

Use `useRuntimeConfig()` to manage environment variables. Only values in the `public` key are exposed to the client.

Validate all server API route inputs using Zod or a validation library. Nuxt server routes are public endpoints.

Use the `nuxt-security` module for automatic security headers, rate limiting, and request size limits.

Implement authentication middleware using Nuxt's `defineNuxtRouteMiddleware` for route-level protection.

Be cautious with `useFetch()` and `$fetch()` on the server side -- validate URLs to prevent SSRF attacks.

Use `setCookie()` with `httpOnly`, `secure`, and `sameSite` options for session management.

Configure CORS carefully in server routes. Nuxt does not apply CORS restrictions by default on API routes.

Avoid rendering unsanitized HTML in Nuxt pages. Use `v-text` instead of `v-html` wherever possible.