nean-sec

Purpose

Ensure NEAN code is secure by default. For security output format and core refusal policy, see /shared-sec-baseline.

NEAN-specific security concerns (always check)

1. SQL injection — use TypeORM parameterized queries; never interpolate user input into raw SQL
2. Input validation — class-validator decorators on all DTOs at every API boundary
3. XSS — Angular sanitizes by default; audit [innerHTML] and bypassSecurityTrust* usage
4. CSRF — required when using cookie-based auth; implement CSRF tokens or use SameSite=Strict
5. Auth/authz gaps — verify authorization in NestJS guards on every protected endpoint, not just frontend
6. Token storage — avoid localStorage for sensitive tokens; prefer httpOnly cookies for refresh tokens
7. Mass assignment — use DTOs with explicit properties; never spread request body directly into entities

Standard security (brief check)

• Error responses: safe exception filters, no stack traces or internal details
• Rate limiting: on auth endpoints, expensive operations, public APIs
• Dependencies: lockfile committed, no known critical vulnerabilities
• Security headers: Helmet middleware configured

Reference

For detailed OWASP/CWE mitigation patterns, see reference/nean-sec-reference.md