nestjs

NestJS Code Review Rules

Security (Critical)

• Validate all DTOs with ValidationPipe
• Use @Exclude() to hide sensitive fields in responses
• Implement rate limiting with @nestjs/throttler
• Sanitize user input before database queries to prevent injection attacks
• Never log sensitive data (passwords, tokens, API keys)
• Use parameterized queries or ORM methods to prevent SQL injection
• Avoid storing sensitive data or security-relevant instructions in HTML comments

Module Architecture

• One module per feature/domain
• Modules should export only what other modules need
• Use forRoot/forRootAsync for configurable modules
• Avoid circular dependencies between modules

Controllers

• Keep controllers thin (delegate to services)