Nestjs security
NestJS security hardening best practices. Use when securing a NestJS app — security headers, rate limiting, CORS, secrets, and input hardening. Triggers on helmet, ThrottlerModule, enableCors, CSRF, rate limiting, or production security review.From its SKILL.md
npx -y skills add dkmqflx/claude-tools --skill nestjs-securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its file declares
Copied from the file, not written here
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.2 KB, 435 tokens by cl100k_base, as published. Nobody here has run it
NestJS Security
Hardening rules for production NestJS apps (v10/v11). These cover the gaps the framework leaves open by default — headers, rate limiting, CORS, secrets, and input validation — for both the Express and Fastify platforms.
When to Apply
- Preparing a NestJS service for production or running a security review.
- Exposing an API to the public internet or to browser clients.
- Adding security headers (helmet), rate limiting (ThrottlerModule), or CORS (enableCors).
- Handling auth: cookie-based sessions, CSRF, or password storage.
- Mitigating DoS via payload-size limits.
Rules
- helmet-security-headers — apply helmet for secure HTTP response headers (Express vs Fastify).
- rate-limiting-throttler — limit abuse with @nestjs/throttler + a global ThrottlerGuard.
- explicit-cors-origins — allowlist explicit origins; never wildcard with credentials.
- validation-as-defense — global ValidationPipe with whitelist to reject unexpected input.
- secrets-from-env — load secrets from env/secret manager; keep them out of git.
- csrf-for-cookie-auth — CSRF protection for cookie-based sessions.
- limit-payload-size — cap request body size to mitigate DoS.
- hash-passwords-and-disable-x-powered-by — bcrypt/argon2 for passwords; drop the x-powered-by header.
How to Use
Read the rule whose topic matches the change you are making, then apply the Correct pattern. When doing a full production review, walk every rule top to bottom as a checklist. Each rule notes Express vs Fastify differences where they matter — confirm which platform adapter the app uses before copying code.
What ships with it: 8 files
10.2 KB alongside SKILL.md