Security Checklist

Passwords are hashed with bcryptjs before storage.
Provider API credentials are read only from environment variables and are never returned by public APIs.
Money columns use SQL DECIMAL; JavaScript money math uses fixed-scale BigInt helpers in src/utils/money.js.
Request bodies are validated server-side with zod.
SQL access goes through Knex query builders and transactions.
Auth, password reset, deposit creation, and order creation have rate limiting.
Every /admin/* route is protected by auth, requireActive, and admin middleware.
Admin self-ban and last-active-admin lockout are rejected.
Order prices are calculated on the server from services.sell_price; client-submitted prices are ignored.
Production environment validation rejects missing or placeholder provider/JWT settings and requires CORS_ORIGIN.
Production CORS allows only configured site origins.
Wallet balance updates are centralized in wallet.service.js and covered by race-condition tests.