Rules
All ESLint security rules provided by eslint-plugin-nestjs-security
6 Security Rules
Essential NestJS security rules for guards, validation pipes, and throttling.
All Rules
| Rule | 🧠 | 💼 | 🔧 | 💡 | ⚠️ | Docs |
|---|---|---|---|---|---|---|
| no-exposed-private-fields This rule detects sensitive fields (like passwords, tokens, secrets) in entity or DTO classes that are not excluded f... | 🟢 | |||||
| no-missing-validation-pipe The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | |||||
| no-permissive-cors Flags CORS configured to accept any origin — a bare enableCors(), origin '*', or the reflecting origin true. | 🟢 | |||||
| no-res-bypass-serialization This rule detects route handlers that inject @Res() without passthrough and then write an object, which silently ... | 🟢 | |||||
| no-unguarded-swagger This rule detects SwaggerModule.setup() running unconditionally in an application bootstrap, which publishes every route, DTO shape and declared auth scheme to anonymous callers in production. | 🟢 | |||||
| require-guards The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | |||||
| require-throttler This rule detects NestJS controllers and route handlers that lack rate limiting, which can make the application vulne... | 🟢 | |||||
| require-validation-pipe-whitelist Requires whitelist true on ValidationPipe, so properties the DTO never declared are stripped instead of reaching the service layer. | 🟢 |
Rule Categories
Authentication & Authorization
Rules requiring proper guards on controllers and endpoints.
Input Validation
Rules enforcing validation pipes and class-validator decorators.
Rate Limiting
Rules requiring throttler configuration to prevent abuse.
Data Protection
Rules preventing exposure of private fields in responses.
Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.