# TS Ddd Security Review

> Security review for TypeScript DDD code — OWASP-mapped checks for injection, auth/authz, data exposure, and misconfiguration. Trigger when the user says "security review", "check for vulnerabilities", "is this secure?", "review auth code", or when changes touch authentication, authorization, input handling, external APIs, file uploads, or user-controlled data.

- Skill: `methasit-pun/ts-ddd-security-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add methasit-pun/ts-ddd-security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/methasit-pun/ts-ddd-security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Methasit-Pun (https://skillmd.com/u/methasit-pun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/methasit-pun/ts-ddd-security-review

---


# Security Review — TypeScript DDD

## Checklist

**Injection (OWASP A03)**
- All DB queries use parameterized queries or ORM methods — no string interpolation in SQL
- Flag every raw query: `query()`, `$queryRaw()`, raw `createQueryBuilder().where()`
- No `child_process.exec()` with user-controlled input — use `execFile()` with argument array

**Auth & Authorization (OWASP A01, A07)**
- JWT secrets from env vars, not hardcoded; `expiresIn` is set
- Passwords hashed with `bcrypt`/`argon2` (min cost 10) — never `md5`, `sha1`, `sha256` alone
- Every protected endpoint has an auth guard
- Authorization checks at **use case level**, not only at the controller
- Resource ownership verified: `userId` from JWT, not from request body
- Can a non-admin call an admin use case by changing a request param?

**Sensitive Data (OWASP A02)**
- Passwords/secrets/PII not logged — check `console.log`, logger calls, error serializers
- Response DTOs exclude `passwordHash`, `internalId`, `adminNotes`
- DB connection strings and API keys in env vars; `.env` in `.gitignore`

**Input Validation (OWASP A03, A04)**
- Request bodies validated at presentation layer (`class-validator`, `zod`, `joi`)
- Validation happens before reaching the application layer
- Max length constraints on text fields; file uploads: type-checked, size-limited, outside webroot
- UUID/ID format validated before hitting the repository

**Security Misconfiguration (OWASP A05)**
- CORS not `origin: '*'` in production
- Helmet headers applied: `X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security`
- Stack traces not exposed in production responses
- Debug endpoints (`/metrics`, `/health`, `/debug`) are internal-only or auth-protected

**Cryptography & Dependencies**
- `crypto.randomBytes()` for token generation — not `Math.random()`
- Secrets compared with `timingSafeEqual()` — not `===` (prevents timing attacks)
- No `rejectUnauthorized: false` in HTTP clients
- `npm audit` run — no high/critical unresolved vulnerabilities
- Rate limiting on auth endpoints (login, register, password reset)

## Severity

- **[CRITICAL]** — Exploitable without auth (SQLi, RCE, auth bypass)
- **[HIGH]** — Requires auth, high impact (privilege escalation, data leak)
- **[MEDIUM]** — Defense-in-depth issue, misconfiguration, limited scope
- **[LOW]** — Hardening improvement, no direct exploitability

## DDD-specific

- Domain events must not carry PII — events may reach external buses
- Value Objects (`Email`, `PhoneNumber`) validate format on construction — natural security boundary
- Aggregate IDs should be UUIDs — sequential IDs allow enumeration attacks

## Output format

Numbered list, most critical first. Each finding: **[SEVERITY] Title** → location + exploit scenario + fix.