eslint-plugin-nestjs-security

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Security rules tailored for NestJS applications (Controllers, Providers, Decorators).

• Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
• How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
• What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-nestjs-security --save-dev

⚙️ Configuration Presets

📚 Supported Libraries

Library	npm	Downloads	Detection
@nestjs/common			Decorators, Guards
@nestjs/core			App Config
class-validator			DTO Validation
@nestjs/throttler			Rate Limiting

⚠️ Global Configuration Handling

NestJS applies guards, pipes and rate limiting application-wide, in a file the controller never imports. Since v1.3.0 the plugin discovers those registrations itself: on the first finding it locates the project root (nearest package.json) and scans the bootstrap and *.module.ts files once, caching the result.

¹ A composite decorator cannot be resolved by a syntax-only linter, so any route carrying a decorator the plugin does not recognise is assumed to be protected. A missed finding is cheaper than a false positive on somebody else's codebase. Set allowCustomDecorators: false on require-guards if you want the strict behaviour back.

ThrottlerGuard registered as APP_GUARD counts as rate limiting, not as authentication — a project that only throttles still gets require-guards findings.

Escape hatch: assumeGlobal* and detectGlobal* options

assumeGlobal*: true disables a rule outright without scanning the project; detectGlobal*: false disables the project scan and restores strict per-file checking:

// eslint.config.js
import nestjsSecurity from 'eslint-plugin-nestjs-security';

export default [
  {
    ...nestjsSecurity.configs.recommended,
    rules: {
      // Tell ESLint: "We have app.useGlobalGuards() in main.ts"
      'nestjs-security/require-guards': ['warn', { assumeGlobalGuards: true }],

      // Tell ESLint: "We have app.useGlobalPipes(new ValidationPipe()) in main.ts"
      'nestjs-security/no-missing-validation-pipe': [
        'warn',
        { assumeGlobalPipes: true },
      ],

      // Tell ESLint: "We have ThrottlerModule.forRoot() in app.module.ts"
      'nestjs-security/require-throttler': [
        'warn',
        { assumeGlobalThrottler: true },
      ],

      // Or keep strict per-file checking and skip the project scan entirely
      // 'nestjs-security/require-guards': ['error', { detectGlobalGuards: false }],
    },
  },
];

Alternative: Use Skip Decorators

The rules recognize common "bypass" decorators for intentionally unprotected endpoints:

// These bypass require-guards
@Public()        // nestjs-passport pattern
@SkipAuth()      // common custom decorator
@AllowAnonymous() // alternative naming
@NoAuth()        // alternative naming

// These bypass require-throttler
@SkipThrottle()  // @nestjs/throttler built-in

Where rate limiting is reported

require-throttler reports once, on the root module (AppModule, or any @Module class in app.module.ts) when no ThrottlerModule is configured anywhere in the project. Rate limiting is adopted with one module registration, so reporting it on every route described a one-line fix as dozens of errors.

📦 Compatibility

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

🔗 Related ESLint Plugins

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

Plugin	Downloads	Description
eslint-plugin-anthropic-security		Anthropic SDK security.
eslint-plugin-browser-security		XSS, DOM security.
eslint-plugin-drizzle-security		Drizzle security.
eslint-plugin-express-security		Express middleware hardening.
eslint-plugin-gemini-security		Google Gemini SDK security.
eslint-plugin-jwt-security		Token security.
eslint-plugin-knex-security		Knex security.
eslint-plugin-lambda-security		AWS Lambda hardening.
eslint-plugin-mcp-sdk-security		MCP SDK security.
eslint-plugin-mongodb-security		MongoDB injection.
eslint-plugin-mysql-security		MySQL security.
eslint-plugin-node-security		Server-side patterns.
eslint-plugin-openai-security		OpenAI SDK security.
eslint-plugin-postgresql-security		PostgreSQL security.
eslint-plugin-prisma-security		Prisma security.
eslint-plugin-secure-coding		Injection prevention.
eslint-plugin-sequelize-security		Sequelize ORM security.
eslint-plugin-sqlite-security		SQLite security.
eslint-plugin-supabase-security		Supabase security.
eslint-plugin-typeorm-security		TypeORM security.
eslint-plugin-vercel-ai-security		AI SDK security.

Code quality

Plugin	Downloads	Description
eslint-plugin-conventions		Team-specific habits and styles.
eslint-plugin-import-next		Fast cycle + import-graph analysis.
eslint-plugin-maintainability		Cognitive load and clean-code patterns.
eslint-plugin-modernization		ESNext migration + syntax evolution.
eslint-plugin-modularity		Structural integrity and DDD patterns.
eslint-plugin-operability		Production readiness and resource health.
eslint-plugin-react-a11y		React accessibility / WCAG.
eslint-plugin-react-features		React best practices and optimization.
eslint-plugin-reliability		Runtime stability and error safety.

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

MIT © Ofri Peretz