nestjs

NestJS Code Review Rules

Security (Critical)

• Template Safety: Review all template variables (e.g., {{...}}) and ensure user input embedded in templates is escaped and not trusted. Never render undeclared template variables. If using template syntax (e.g., {{variable}}), validate and escape all variables before rendering to prevent injection
• Comment Hygiene: Never use HTML comments (<!-- -->) for sensitive data or instructions. Ensure HTML comments are stripped from source before deployment
• Validate all DTOs with ValidationPipe
• Use @Exclude() to hide sensitive fields in responses
• Implement rate limiting with @nestjs/throttler
• Sanitize user input before database queries to prevent injection attacks
• Never log sensitive data (passwords, tokens, API keys)
• Use parameterized queries or ORM methods to prevent SQL injection

Module Architecture (Essential)

• One module per feature/domain
• Modules should export only what other modules need
• Use forRoot/forRootAsync for configurable modules
• Avoid circular dependencies between modules