SvelteKit Security Checklist

Use `$env/static/private` and `$env/dynamic/private` for server-only secrets. Never import from `$env/static/public` for sensitive values.

SvelteKit has built-in CSRF protection for form actions. Ensure you are using form actions rather than custom API endpoints for state-changing operations.

Validate all data in `+server.ts` endpoints and `+page.server.ts` load functions. These are public-facing server endpoints.

Use hooks (`hooks.server.ts`) for global authentication and authorization checks before requests reach route handlers.

Configure security headers in `svelte.config.js` or through hooks. SvelteKit does not set security headers by default.

Be cautious with `event.locals` -- data set here is available to all subsequent handlers in the request pipeline.

Implement rate limiting in hooks or middleware, especially for form actions and API endpoints.

Use `+page.server.ts` load functions to keep data fetching on the server. Avoid exposing internal API URLs in client-side code.