Remix Security Checklist

Remix loaders and actions run on the server. Keep secrets in server-only code and never return sensitive data that the client does not need.

Validate all action form data using Zod or similar. Remix actions are public endpoints that accept form submissions.

Use Remix's built-in `createCookieSessionStorage` for secure session management with HttpOnly, Secure, and SameSite attributes.

Implement CSRF protection using Remix's convention of checking the Origin header or using a CSRF token library.

Sanitize data returned from loaders before rendering. While Remix auto-serializes loader data, the rendered output must still be safe.

Use `defer()` and `Await` carefully -- ensure deferred data does not expose sensitive information in error states.

Implement route-level authorization in loaders. Throw `redirect()` or `json({ error }, { status: 403 })` for unauthorized access.

Configure security headers using Remix's `entry.server.tsx` or a reverse proxy. Set CSP, HSTS, and X-Frame-Options.