/devkit.ts.security-review

allowed-tools: Read, Write, Edit, Bash, Grep, Glob
argument-hint: "[scope] [options]"
description: Provides comprehensive security review for TypeScript/Node.js applications (Next.js, NestJS, Express, etc.). Use when auditing security vulnerabilities or before deploying to production.

Overview

Provides comprehensive security review for TypeScript/Node.js applications (Next.js, NestJS, Express, etc.). Use when auditing security vulnerabilities or before deploying to production.

Usage

/devkit.ts.security-review $ARGUMENTS

Arguments

| Argument | Description | |--------------|------------------------------------------| | `$ARGUMENTS` | Combined arguments passed to the command |

Execution Steps

Execute comprehensive security review for TypeScript/Node.js applications. Analyze vulnerabilities, dependencies, security configurations, and best practices specific to the TypeScript ecosystem.

Execution Steps

1. **Setup Analysis Environment**

• Prepare codebase for review
• Configure security scanning tools
• Set up reporting framework

2. **Automated Security Scanning**

• Run npm audit for vulnerabilities
• Execute ESLint security rules
• Perform static analysis with Semgrep
• Scan dependencies with Snyk

3. **Manual Security Review**

• Review authentication/authorization logic
• Analyze input validation patterns
• Check API endpoint security
• Review database security configurations

4. **Framework-Specific Analysis**

• Review Next.js security configurations
• Analyze NestJS guard implementations
• Check Express.js middleware security
• Review frontend security patterns

5. **Generate Security Report**

• Consolidate findings from all tools
• Prioritize vulnerabilities by risk
• Provide actionable remediation steps
• Create implementation timeline

6. **Security Recommendations**

• Framework-specific security improvements
• TypeScript security best practices
• Configuration security enhancements
• Monitoring and alerting setup

Target: $ARGUMENTS

Execution Instructions

**Agent Selection**: To execute this TypeScript security review, use the following agent with fallback:

• Primary: `developer-kit-typescript:ts-security-expert`
• If not available: Use `developer-kit-typescript:ts-security-expert` or fallback to `general-purpose` agent with

security expertise

Security Analysis for TypeScript/Node.js Applications

Main Analysis Areas

**Security Review Scope**: $ARGUMENTS

1. OWASP Top 10 Vulnerability Analysis for TypeScript

Analyze the following vulnerability categories in TypeScript context:

A01: Broken Access Control

• Verify authentication middleware implementations (Express.js, NestJS guards)
• Analyze JWT token validation and refresh mechanisms
• Check role-based access control (RBAC) patterns
• Verify API route protection in Next.js API routes
• Review GraphQL resolvers authorization

A02: Cryptographic Failures

• Analyze crypto library usage (Node.js crypto, bcryptjs)
• Verify password hashing implementations
• Check SSL/TLS configurations for Node.js servers
• Review secrets management (dotenv, config libraries)
• Validate encryption/decryption patterns

A03: Injection

• SQL Injection in TypeORM/Prisma/Sequelize
• NoSQL Injection in MongoDB/Mongoose
• Command Injection in child_process.exec/execSync
• Template Injection in Handlebars/EJS/JSX
• XSS in React/Vue/Angular components

A04: Insecure Design

• Missing security middleware (Helmet, CORS)
• Insecure architectural patterns in microservices
• Lack of input validation strategy
• Insecure API design patterns
• Missing rate limiting configurations

A05: Security Misconfiguration

• Insecure Express.js/NestJS configurations
• Exposed development endpoints
• CORS misconfigurations
• Insecure default settings in production
• Missing security headers

A06: Vulnerable and Outdated Components

• npm/yarn dependency scanning (npm audit, yarn audit)
• Libraries with known CVEs
• Outdated Node.js/TypeScript versions
• Vulnerable transitive dependencies
• Malicious package detection

A07: Identification and Authentication Failures

• Weak password policies in authentication systems
• Insecure session management
• Improper JWT implementation
• Missing MFA implementation
• Insecure OAuth flows

A08: Software and Data Integrity Failures

• Missing package integrity verification (npm package-lock.json)
• Insecure CI/CD pipeline configurations
• Lack of code signing for critical operations
• Deserialization vulnerabilities (JSON.parse)
• Missing checksum validation

A09: Security Logging and Monitoring Failures

• Inadequate security logging (Winston, Pino)
• Missing audit trail implementation
• Absent security event monitoring
• Insufficient error handling that leaks information
• Missing intrusion detection

A10: Server-Side Request Forgery (SSRF)

• Analyze HTTP calls (axios, node-fetch)
• Missing URL validation in API requests
• Insecure proxy configurations
• File inclusion attacks via require/import
• Open redirect vulnerabilities

2. Framework-Specific Security Analysis

Next.js Security Analysis

• API route security configurations
• Server-side rendering (SSR) security
• Static site generation (SSG) security
• Middleware security implementations
• NextAuth.js configuration review

NestJS Security Analysis

• Guard implementations (AuthGuard, RolesGuard)
• Passport strategy configurations
• Interceptor security patterns
• Exception filter security
• Module dependency security

Express.js Security Analysis

• Middleware security configurations
• Route protection patterns
• Error handling security
• Session management
• Helmet/CORS implementations

3. Dependencies and Libraries Analysis

npm/yarn Dependency Analysis

# Run vulnerability scan
npm audit
npm audit fix
yarn audit
ya