Instruction file imported from srnichols/Falsify (.github/instructions/security.instructions.md). Copyright stays with the author.

TypeScript Security Patterns

Input Validation (Zod)

import { z } from 'zod';

// ✅ Validate all incoming data
const CreateUserSchema = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100),
  role: z.enum(['user', 'admin']),
});

type CreateUserInput = z.infer<typeof CreateUserSchema>;

// In route handler
const parsed = CreateUserSchema.safeParse(req.body);
if (!parsed.success) {
  return res.status(400).json({ errors: parsed.error.flatten() });
}

Authentication

JWT Middleware (Express)

import { expressjwt } from 'express-jwt';
import jwksRsa from 'jwks-rsa';

const authMiddleware = expressjwt({
  secret: jwksRsa.expressJwtSecret({
    jwksUri: `${process.env.AUTH_ISSUER}/.well-known/jwks.json`,
  }),
  audience: process.env.AUTH_AUDIENCE,
  issuer: process.env.AUTH_ISSUER,
  algorithms: ['RS256'],
});

Secrets Management

// ❌ NEVER: Hardcoded secrets
const dbPassword = 'secret123';

// ✅ ALWAYS: Environment variables
const dbPassword = process.env.DATABASE_PASSWORD;
if (!dbPassword) throw new Error('DATABASE_PASSWORD not set');

// ✅ BEST: Validated config
import { z } from 'zod';
const envSchema = z.object({
  DATABASE_URL: z.string().url(),
  JWT_SECRET: z.string().min(32),
  NODE_ENV: z.enum(['development', 'production', 'test']),
});
const env = envSchema.parse(process.env);

SQL Injection Prevention

// ❌ NEVER: String interpolation
const result = await db.query(`SELECT * FROM users WHERE id = '${id}'`);

// ✅ ALWAYS: Parameterized
const result = await db.query('SELECT * FROM users WHERE id = $1', [id]);

// ✅ BEST: Use ORM (Prisma prevents injection by default)
const user = await prisma.user.findUnique({ where: { id } });

Type Safety

// ❌ NEVER: `any` type
function processData(data: any) { ... }

// ✅ ALWAYS: Explicit types
function processData(data: UserInput): ProcessedUser { ... }

// ❌ NEVER: Type assertions to bypass safety
const user = rawData as User;

// ✅ ALWAYS: Runtime validation
const user = UserSchema.parse(rawData);

CORS Configuration

import cors from 'cors';

app.use(cors({
  origin: process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000'],
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
}));

Rate Limiting

import rateLimit from 'express-rate-limit';

// Global rate limiter
const globalLimiter = rateLimit({
  windowMs: 60 * 1000,  // 1 minute
  max: 1000,            // per IP
  standardHeaders: true, // RateLimit-* headers
  legacyHeaders: false,
  message: { title: 'Too Many Requests', status: 429 },
});
app.use(globalLimiter);

// Tenant-scoped rate limiter
const tenantLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 100,
  keyGenerator: (req) => req.tenantId ?? req.ip,
});
app.use('/api/', tenantLimiter);

Security Headers

import helmet from 'helmet';

// Helmet sets secure headers automatically
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
    },
  },
  hsts: { maxAge: 31536000, includeSubDomains: true },
  frameguard: { action: 'deny' },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
}));
// Sets: X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security,
//       Content-Security-Policy, Referrer-Policy, X-XSS-Protection

Common Vulnerabilities to Prevent

OWASP Top 10 (2021) Alignment

See Also

• auth.instructions.md — JWT/JWKS, middleware guards, multi-tenant isolation, API keys
• graphql.instructions.md — GraphQL authorization, resolver-level auth context
• dapr.instructions.md — Dapr secrets management, component scoping, mTLS
• database.instructions.md — SQL injection prevention, parameterized queries
• api-patterns.instructions.md — Auth middleware, request validation
• deploy.instructions.md — Secrets management, TLS configuration

Temper Guards

Warning Signs

• Route handlers missing auth middleware or guard decorators
• String interpolation or template literals used in SQL queries (SELECT ... ${id} )
• Secrets assigned as string literals (const key = "abc123")
• CORS configured with wildcard origin ("*")
• Missing CSRF protection on state-changing endpoints
• Error responses expose stack traces or internal paths in non-development mode