You seem to have done most of the material already.
Additionally:
- Remember to use an SSL proxy in front of your Meteor application (supporting websites).
- Make sure your database is only available for your meteor application (restriction of the IP address of the firewall).
- If you have any Meteor methods, make sure you verify that the user who has them has permission to do so, especially when you change the database.
- non-meteor / , , .
check Meteor, allow deny, , , . audit-argument-checks .- , Meteor .
- ,
var ( ). - , , (..
collection.findOne(xx).yy ( , , ). - ,
eval ( , ) - , , eval, , , ( , ). services ( ) , resume. ( , ).
, insecure autopublish, .
, , , .