TypeScript Security Review

Overview

This skill provides structured, comprehensive security review for TypeScript and Node.js applications. It evaluates code against OWASP Top 10, framework-specific security best practices, and production-readiness security criteria. The review produces actionable findings classified by severity (Critical, High, Medium, Low) with concrete remediation examples.

This skill delegates to the

typescript-security-expert

agent for deep security analysis when invoked through the agent system.

When to Use

Performing security audits on TypeScript/Node.js codebases

Reviewing authentication and authorization implementations (JWT, OAuth2, Passport.js)

Checking for common vulnerabilities (XSS, injection, CSRF, path traversal)

Validating input validation and sanitization logic

Reviewing dependency security (npm audit, known CVEs)

Checking secrets management and environment variable handling

Assessing API security (rate limiting, CORS, security headers)

Reviewing Express, NestJS, or Next.js security configurations

Before deploying to production or after significant code changes

Compliance checks (GDPR, HIPAA, SOC2 data handling requirements)

Instructions

Identify Scope

Determine which files and modules are under security review. Prioritize authentication, authorization, data handling, API endpoints, and configuration files. Use

grep

to find security-sensitive patterns (

eval

,

exec

,

innerHTML

, password handling, JWT operations).

Check Authentication & Authorization

Review JWT implementation (signing algorithm, expiration, refresh tokens), OAuth2/OIDC integration, session management, password hashing (bcrypt/argon2), and multi-factor authentication. Verify that all protected routes enforce authentication.

Scan for Injection Vulnerabilities

Check for SQL/NoSQL injection in database queries, command injection in

exec

/

spawn

, template injection, and LDAP injection. Verify that all user input is validated and parameterized queries are used.

Review Input Validation

Check that all API inputs are validated with Zod, Joi, or class-validator. Verify schema completeness — no missing fields, proper type constraints, length limits, and format validation. Check for validation bypass paths.

Assess XSS Prevention

Review React component output for

dangerouslySetInnerHTML

usage, check Content Security Policy headers, verify HTML sanitization for user-generated content, and check template rendering in server-side code.

Check Secrets Management

Scan for hardcoded credentials, API keys, and secrets in source code. Verify

.env

files are gitignored, environment variables are validated at startup, and secrets are accessed through proper management services.

Review Dependency Security

Run

npm audit

or check

package-lock.json

for known vulnerabilities. Identify outdated dependencies with known CVEs. Check for unnecessary dependencies that increase attack surface.

Evaluate Security Headers & Configuration

Check for helmet.js or manual security header configuration. Review CORS policy, rate limiting, HTTPS enforcement, cookie security flags (HttpOnly, Secure, SameSite), and CSP configuration.
Produce Security Report: Generate a structured report with severity-classified findings (Critical, High, Medium, Low), remediation guidance with code examples, and a security posture summary. Examples Example 1: JWT Security Review // ❌ Critical: Weak JWT configuration import jwt from 'jsonwebtoken' ; const SECRET = 'mysecret123' ; // Hardcoded weak secret function generateToken ( user : User ) { return jwt . sign ( { id : user . id , role : user . role } , SECRET ) ; // Missing expiration, weak secret, no algorithm specification } function verifyToken ( token : string ) { return jwt . verify ( token , SECRET ) ; // No algorithm restriction } // ✅ Secure: Proper JWT configuration import jwt from 'jsonwebtoken' ; import { randomBytes } from 'crypto' ; const JWT_SECRET = process . env . JWT_SECRET ; if ( ! JWT_SECRET || JWT_SECRET . length < 32 ) { throw new Error ( 'JWT_SECRET must be set and at least 32 characters' ) ; } function generateToken ( user : User ) : string { return jwt . sign ( { sub : user . id } , // Minimal claims, no sensitive data JWT_SECRET , { algorithm : 'HS256' , expiresIn : '15m' , issuer : 'my-app' , audience : 'my-app-client' , } ) ; } function verifyToken ( token : string ) : JwtPayload { return jwt . verify ( token , JWT_SECRET , { algorithms : [ 'HS256' ] , // Restrict accepted algorithms issuer : 'my-app' , audience : 'my-app-client' , } ) as JwtPayload ; } Example 2: SQL Injection Prevention // ❌ Critical: SQL injection vulnerability async function findUser ( email : string ) { const result = await db . query ( SELECT * FROM users WHERE email = ' ${ email } ' ) ; return result . rows [ 0 ] ; } // ✅ Secure: Parameterized query async function findUser ( email : string ) { const result = await db . query ( 'SELECT id, name, email FROM users WHERE email = $1' , [ email ] ) ; return result . rows [ 0 ] ; } // ✅ Secure: ORM with type-safe queries (Drizzle example) async function findUser ( email : string ) { return db . select ( { id : users . id , name : users . name , email : users . email , } ) . from ( users ) . where ( eq ( users . email , email ) ) . limit ( 1 ) ; } Example 3: Input Validation // ❌ High: Missing input validation app . post ( '/api/users' , async ( req , res ) => { const user = await createUser ( req . body ) ; res . json ( user ) ; } ) ; // ✅ Secure: Comprehensive input validation with Zod import { z } from 'zod' ; const createUserSchema = z . object ( { name : z . string ( ) . min ( 1 ) . max ( 100 ) . trim ( ) , email : z . string ( ) . email ( ) . max ( 254 ) . toLowerCase ( ) , password : z . string ( ) . min ( 12 , 'Password must be at least 12 characters' ) . regex ( / [ A - Z ] / , 'Must contain uppercase letter' ) . regex ( / [ a - z ] / , 'Must contain lowercase letter' ) . regex ( / [ 0 - 9 ] / , 'Must contain a number' ) , role : z . enum ( [ 'user' , 'editor' ] ) . default ( 'user' ) , } ) ; app . post ( '/api/users' , async ( req , res ) => { const result = createUserSchema . safeParse ( req . body ) ; if ( ! result . success ) { return res . status ( 400 ) . json ( { errors : result . error . flatten ( ) } ) ; } const user = await createUser ( result . data ) ; res . status ( 201 ) . json ( user ) ; } ) ; Example 4: XSS Prevention // ❌ High: XSS vulnerability through dangerouslySetInnerHTML function Comment ( { content } : { content : string } ) { return < div dangerouslySetInnerHTML = { { __html : content } } /> ; } // ✅ Secure: Sanitize HTML before rendering import DOMPurify from 'isomorphic-dompurify' ; function Comment ( { content } : { content : string } ) { const sanitized = DOMPurify . sanitize ( content , { ALLOWED_TAGS : [ 'b' , 'i' , 'em' , 'strong' , 'a' , 'p' , 'br' ] , ALLOWED_ATTR : [ 'href' , 'target' , 'rel' ] , } ) ; return < div dangerouslySetInnerHTML = { { __html : sanitized } } /> ; } // ✅ Better: Use a markdown renderer instead of raw HTML import ReactMarkdown from 'react-markdown' ; function Comment ( { content } : { content : string } ) { return < ReactMarkdown

{ content } </ ReactMarkdown

; } Example 5: Security Headers and Configuration // ❌ Medium: Missing security headers and permissive CORS const app = express ( ) ; app . use ( cors ( ) ) ; // Allows all origins // ✅ Secure: Comprehensive security configuration import helmet from 'helmet' ; import cors from 'cors' ; import rateLimit from 'express-rate-limit' ; const app = express ( ) ; app . use ( helmet ( { contentSecurityPolicy : { directives : { defaultSrc : [ "'self'" ] , scriptSrc : [ "'self'" ] , styleSrc : [ "'self'" , "'unsafe-inline'" ] , imgSrc : [ "'self'" , 'data:' , 'https:' ] , } , } , hsts : { maxAge : 31536000 , includeSubDomains : true , preload : true } , } ) ) ; app . use ( cors ( { origin : process . env . ALLOWED_ORIGINS ?. split ( ',' ) ?? [ ] , credentials : true , methods : [ 'GET' , 'POST' , 'PUT' , 'DELETE' ] , } ) ) ; app . use ( rateLimit ( { windowMs : 15 * 60 * 1000 , max : 100 , standardHeaders : true , legacyHeaders : false , } ) ) ; Review Output Format Structure all security review findings as follows: 1. Security Posture Summary Overall security assessment score (1-10) with key observations and risk level. 2. Critical Vulnerabilities (Immediate Action) Issues that can be exploited to compromise the system, steal data, or cause unauthorized access. 3. High Priority (Address Within 30 Days) Security misconfigurations, missing protections, or vulnerabilities requiring near-term remediation. 4. Medium Priority (Address Within 90 Days) Issues that reduce security posture but have mitigating factors or limited exploitability. 5. Low Priority (Next Cycle) Security improvements, hardening recommendations, and defense-in-depth enhancements. 6. Positive Security Observations Well-implemented security patterns and practices to acknowledge. 7. Remediation Roadmap Prioritized action items with code examples for the most critical fixes. Best Practices Validate all inputs at the API boundary — never trust client-side validation alone Use parameterized queries or ORMs — never concatenate user input into queries Store secrets in environment variables or secret managers — never in source code Apply the principle of least privilege for database accounts, API keys, and IAM roles Enable security headers (helmet.js) and restrict CORS to known origins Implement rate limiting on all public-facing endpoints Hash passwords with bcrypt or argon2 — never use MD5/SHA for passwords Set cookie flags: HttpOnly , Secure , SameSite=Strict Use npm audit in CI pipelines to catch dependency vulnerabilities Log security events (failed logins, permission denials) without logging sensitive data Constraints and Warnings Security review is not a substitute for professional penetration testing Focus on code-level vulnerabilities — infrastructure security is out of scope Respect the project's framework — provide framework-specific remediation guidance Do not log, print, or expose discovered secrets — report their location only Dependency vulnerabilities should be assessed for actual exploitability, not just presence Security recommendations must be practical — consider implementation effort vs risk reduction References See the references/ directory for detailed security documentation: references/owasp-typescript.md — OWASP Top 10 mapped to TypeScript/Node.js patterns references/common-vulnerabilities.md — Common vulnerability patterns and remediation references/dependency-security.md — Dependency scanning and supply chain security guide

typescript-security-review

安装