Code Review Standards

## Node PR Review Checklist
 
### Blockers (must fix)
- [ ] No floating promises (`@typescript-eslint/no-floating-promises`)
- [ ] DB queries parameterized (no string concat SQL)
- [ ] No secrets, tokens, or PII in logs
- [ ] `try/finally` or `using` for acquired connections/streams
- [ ] Migrations backward-compatible with N-1 deploy
- [ ] AuthZ check on every mutating route
 
### Should fix
- [ ] Timeouts on outbound HTTP (`AbortSignal.timeout`)
- [ ] Rate limit on public endpoints
- [ ] Tests for error paths, not only happy path
 
### Nits (optional)
- [ ] Naming, comment clarity

// BLOCK: floating promise - handler returns before work completes
app.get("/bad", (req, res) => {
  fetchData().then((d) => res.json(d)); // no .catch
});
 
// OK: async handler with explicit error propagation (Express 5 passes to error middleware)
app.get("/good", async (req, res) => {
  const data = await fetchData();
  res.json(data);
});

// BLOCK: SQL injection
const id = req.params.id;
await pool.query(`SELECT * FROM users WHERE id = ${id}`);
 
// OK: parameterized
await pool.query("SELECT * FROM users WHERE id = $1", [id]);

// BLOCK: PII in logs
req.log.info({ email: user.email, ssn: user.ssn });
 
// OK: redacted identifiers
req.log.info({ userId: user.id, action: "login" });

// BLOCK: connection leak on error path
const client = await pool.connect();
const result = await client.query("SELECT 1");
client.release();
 
// OK: always release
const client = await pool.connect();
try {
  return await client.query("SELECT 1");
} finally {
  client.release();
}

const REDACT = ["password", "token", "email", "ssn", "authorization"];
// Use pino redact paths: ['req.headers.authorization', 'body.password']

[ ] Expand step only in this PR?
[ ] Down migration exists OR forward-fix documented?
[ ] Index CONCURRENTLY for large tables?
[ ] Worker job payload still compatible?