better-auth-security-best-practices

<!-- 🔒 LOCKED — managed by clade · auto-generated by sync-to-cursor; edit source in .claude/ then re-run sync --> ## Secret Management ### Configuring the Secret ```ts import { betterAuth } from "better-auth"; export const auth = betterAuth({ secret: process.env.BETTER_AUTH_SECRET, // or via `BETTER_AUTH_SECRET` env }); ``` Better Auth looks for secrets in this order: 1. `options.secret` in your config 2. `BETTER_AUTH_SECRET` environment variable 3. `AUTH_SECRET` environment variable ### Secret Requirements - Rejects default/placeholder secrets in production - Warns if shorter than 32 characters or entropy below 120 bits - Generate: `openssl rand -base64 32` - Never commit secrets to version control ## Rate Limiting Enabled in production by default. Applies to all endpoints. Plugins can override per-endpoint. ### Default Configuration ```ts import { betterAuth } from "better-auth"; export const auth = betterAuth({ rateLimit: { enabled: true, // Default: true in production window: 10, // Time window in seconds (default: 10) max: 100, // Max requests per window (default: 100) }, }); ``` ### Storage Options Options: `"memory"` (resets on restart, avoid on serverless), `"database"` (persistent), `"secondary-storage"` (Redis, default when available). ```ts rateLimit: { storage: "database", } ``` ### Custom Storage Implement your own rate limit storage: ```ts rateLimit: { customStorage: { get: async (key) => { // Return { count: nu...