Secure Coding Practices

This skill is a per-feature implementation checklist — not a threat model. Apply it when writing new code or reviewing a PR.

1. Input Validation — Zod at Every Boundary

Rule: Every external input (query params, request body, path params) must be validated through a Zod schema before reaching the service layer. Never trust raw req.body.

// ✅ Body validated via @ZodBody() or NestJS Pipes — shape guaranteed before service call
@Post()
create(@Body() dto: CreateShowDto) {  // dto already Zod-validated
  return this.showService.create(dto);
}