| 1 | # Security Guidelines |
| 2 | |
| 3 | ## Mandatory Security Checks |
| 4 | |
| 5 | Before ANY commit: |
| 6 | - [ ] No hardcoded secrets (API keys, passwords, tokens) |
| 7 | - [ ] All user inputs validated (Zod DTOs at controller boundary) |
| 8 | - [ ] MongoDB injection prevention (validate query parameters, avoid `$where`, sanitize `$regex` inputs) |
| 9 | - [ ] XSS prevention (sanitized HTML) |
| 10 | - [ ] Authentication/authorization verified |
| 11 | - [ ] Rate limiting on public endpoints |
| 12 | - [ ] Error messages don't leak sensitive data |
| 13 | |
| 14 | ## Secret Management |
| 15 | |
| 16 | ```typescript |
| 17 | // NEVER: Hardcoded secrets or direct process.env |
| 18 | const apiKey = "sk-proj-xxxxx" // ❌ |
| 19 | const apiKey = process.env.OPENAI_API_KEY // ❌ must go through config module |
| 20 | |
| 21 | // ALWAYS: Use zod config schema + selectConfig |
| 22 | // Define in config.ts with zod schema, access via injected config object |
| 23 | const apiKey = this.config.openai.apiKey |
| 24 | ``` |
| 25 | |
| 26 | ## MongoDB-Specific Security |
| 27 | |
| 28 | - Validate ObjectId format on all ID parameters before querying |
| 29 | - Use `lean()` queries to avoid returning Mongoose document methods |
| 30 | - Never expose raw `_id` in API responses — transform via VO |
| 31 | - Sanitize string inputs used in `$regex` queries |
| 32 | |
| 33 | ## NestJS Security |
| 34 | |
| 35 | - Use Guards for authentication, not middleware |
| 36 | - Use `@GetToken()` decorator from `@yikart/aitoearn-auth` for extracting auth info |
| 37 | - Filter permissions via query conditions in Service layer (not Controller) |
| 38 | |
| 39 | ## Security Response Protocol |
| 40 | |
| 41 | If security issue found: |
| 42 | 1. STOP immediately |
| 43 | 2. Use **security-reviewer** agent |
| 44 | 3. Fix CRITICAL issues before continuing |
| 45 | 4. Rotate any exposed secrets |
| 46 | 5. Review entire codebase for similar issues |
| 47 |