Injection protection, proven by test

Audit every endpoint for SQL injection - it should already be safe via parameterised queries, so verify with a test - and sanitise user-generated content rendered elsewhere, such as comment bodies.

"We use an ORM so we're safe" is usually true and occasionally catastrophically false, at exactly the one place someone dropped to raw SQL. A test is the difference between believing and knowing.