01Local signup with OTP email confirmation and Google OAuth2 sign-in via idToken
02JWT access tokens (1h) and refresh tokens (1y) with jwtid linking
03OTP rate limiting via Redis: max 3 attempts per 5 minutes with 5-minute block
04Repository Pattern with generic BaseRepository<T> abstracting all Mongoose operations
05Posts with text and multi-media attachments, privacy settings (public/private/onlyMe), and tagging
06Paginated privacy-aware feed with six-type reaction toggle system
07Infinite nested comment/reply system with cascading deletion of subtrees and S3 files
08Friend request system with send, accept, reject, cancel, and remove actions
09Real-time one-to-one chat via Socket.io with JWT handshake auth and Redis socket storage
10AWS S3 direct upload via pre-signed URLs, multipart upload, and private file streaming
11Firebase push notifications for logins, friend requests, tags, and reactions
12AES-256-CBC encryption for phone numbers at rest, bcrypt with 12 rounds for passwords