skills.rest
SleyiW
SleyiWCOMMUNITY
Explore all skills by this author →
GitHub

backend-security-coder

Implements secure NestJS backend code with Zod validation, multi-tenant isolation, and audit trails.

Updated Apr 4, 2026
Search Tags:#security#multi-tenant#jwt#backend#zod#nestjs#typeorm
One-click install
npx skills add https://github.com/SleyiW/iWana-neXt --skill backend-security-coder-sleyiw
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: backend-security-coder
Source: https://github.com/SleyiW/iWana-neXt/tree/main/.agents/skills/backend-security-coder
Command: npx skills add https://github.com/SleyiW/iWana-neXt --skill backend-security-coder-sleyiw

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Backend developers often ship endpoints with missing input validation, broken tenant isolation, SQL injection risks, or PII leaks in logs. This Skill provides concrete security rules and checklists for implementing and reviewing secure backend code in the iWana neXt stack (NestJS, Zod, TypeORM, PostgreSQL multi-tenant by schema, JWT). ## Core Features & Use Cases - Runtime Input Validation: Enforces Zod validation on all external boundaries including HTTP bodies, params, queries, queue payloads, and environment configuration. - Multi-Tenant Security: Ensures tenant resolution and propagation per request with schema-level isolation in PostgreSQL, preventing cross-tenant data access. - AuthN/AuthZ Controls: Guides JWT with refresh token rotation, MFA, RBAC/ABAC authorization, and secure password hashing. - Use Case: When adding a new public endpoint to a NestJS module, use this Skill to verify it has rate limiting, restrictive CORS, validated input, parameterized TypeORM queries, sanitized logs, and an audit trail for sensitive writes. ## Quick Start Review this NestJS endpoint for security issues and fix any missing validation, tenant isolation, or audit logging.

Frequently Asked Questions about backend-security-coder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate request input in NestJS with Zod?▼

Validate all external input at runtime with Zod schemas covering body, params, and query of HTTP endpoints, plus queue payloads and environment configuration. TypeScript types alone are not a substitute for runtime validation.

How to implement multi-tenant isolation in PostgreSQL with TypeORM?▼

Resolve the tenant per authenticated request, propagate it through use cases and services, and enforce schema-level isolation. Never hardcode tenant or schema values, and avoid optional tenantId parameters without a clear contract.

What security controls do public NestJS endpoints need?▼

Public endpoints require mandatory rate limiting, CORS restricted to approved origins, payload size limits, and consistent error responses that do not leak internal details. Authentication is separate from authorization checks.

How do I prevent SQL injection when using TypeORM?▼

Use repositories, query builders, and bound parameters instead of concatenating SQL with external data. Explicitly control dynamic filters and allowed sort fields, and validate any dynamic identifier before interpolating it.

What should backend logs never contain?▼

Logs must never contain passwords, tokens, sensitive documents, full request payloads, or real PII. Sanitize messages derived from external input and use error codes with operational context instead of raw stack traces.

When should a backend operation have an audit trail?▼

Any sensitive write operation requires an audit trail recording who executed the action, on which tenant and resource, when it occurred, and the result. Audit logging is not a future improvement for already-sensitive operations.

Related Skills

Explore More Software Engineering Skills→
valuedrivenvaluedriven
4

nestjs-best-practices

Apply NestJS design and architectural best practices to modules, controllers, and services.

Community
Advanced
CrashBytesCrashBytes
6

infosec-engineer

Conduct security assessments, threat modeling, and compliance reviews.

Community
Advanced
physics91physics91

infra-security-reviewer

Identify security gaps in Terraform, Pulumi, Kubernetes, and AWS/GCP/Azure configurations.

Community
Advanced
coreindustriescoreindustries
1

scan

Execute automated security scans for dependency vulnerabilities, static code analysis, and secrets detection.

Community
Advanced