nestjs-security-validatorlisted
Install: claude install-skill smicolon/ai-kit
# NestJS Security Validator
Enforces security defaults and defensive programming across NestJS applications.
## 1. Global Input Validation (ValidationPipe)
In `main.ts`, always configure `ValidationPipe` with stripping and rejection of unwhitelisted properties to prevent parameter injection:
```typescript
// main.ts
import { ValidationPipe } from '@nestjs/common'
async function bootstrap() {
const app = await NestFactory.create(AppModule)
app.useGlobalPipes(
new ValidationPipe({
whitelist: true, // Strips properties without decorators in DTO
forbidNonWhitelisted: true, // Throws error if unknown property is sent
transform: true, // Auto-transforms payloads to DTO instance types
transformOptions: {
enableImplicitConversion: false, // Explicit types only
},
}),
)
}
```
---
## 2. Rate Limiting (`@nestjs/throttler` v5+)
Prevent brute-force and DoS attacks:
```typescript
// app.module.ts
import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler'
import { APP_GUARD } from '@nestjs/core'
@Module({
imports: [
ThrottlerModule.forRoot([
{
name: 'short',
ttl: 1000,
limit: 10, // 10 requests per second
},
{
name: 'medium',
ttl: 60000,
limit: 100, // 100 requests per minute
},
]),
],
providers: [
{
provide: APP_GUARD,
useClass: ThrottlerGuard,
},
],
})
export class AppModule {}
```