@runsec/mcp 1.0.28 → 1.0.37

package/dist/data/skills/nodejs-nestjs/patterns.md

@@ -0,0 +1,288 @@
+| ID | Название метрики | Anti-Pattern (Vulnerable Code/YAML) | Safe-Pattern (Remediation) | Stack | Источник  fix_template | Exploit scenario |
+|---|---|---|---|---|---|---|
+| NST-001 | Prototype Pollution в DTO merge | `const dto = req.body`<br>`...`<br>`Object.assign(target, dto)` | `const dto = req.body`<br>`...`<br>`for (const k of Object.keys(dto)) {`<br>`  if (["__proto__", "constructor", "prototype"].includes(k)) throw new Error("blocked")`<br>`}` | Node.js/NestJS | `CWE-1321` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-001 prototype pollution в dto merge const req body object assign target for k of keys if proto constructor includes throw -->
+| NST-002 | Insecure CORS (`origin: *`) | `app.enableCors({ origin: "*", credentials: true })` | `app.enableCors({ origin: ["https://app.example.com"], credentials: true })` | Node.js/NestJS | `CWE-942` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-002 insecure cors origin app enablecors credentials true https example com -->
+| NST-003 | Missing global ValidationPipe | `const app = await NestFactory.create(AppModule)` | `const app = await NestFactory.create(AppModule)`<br>`app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true }))` | Node.js/NestJS | `CWE-20` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-003 missing global validationpipe const app await nestfactory create appmodule useglobalpipes new whitelist true forbidnonwhitelisted -->
+| NST-004 | TypeORM SQL Injection (query string concat) | `const q = "SELECT * FROM users WHERE email = '" + email + "'"`<br>`...`<br>`await dataSource.query(q)` | `await dataSource.query("SELECT * FROM users WHERE email = $1", [email])` | Node.js/NestJS | `CWE-89` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-004 typeorm sql injection query string concat const q select from users where email await datasource 1 -->
+| NST-005 | Prisma Raw Injection (`$queryRawUnsafe`) | `await prisma.$queryRawUnsafe("SELECT * FROM users WHERE id = " + id)` | `await prisma.$queryRaw\`SELECT * FROM users WHERE id = ${id}\`` | Node.js/NestJS | `CWE-89` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-005 prisma raw injection queryrawunsafe await select from users where id queryraw -->
+| NST-006 | Open Redirect in controller | `return res.redirect(req.query.next as string)` | `const next = String(req.query.next | Node.js/NestJS | "/")`<br>`if (!next.startsWith("/")) return res.redirect("/")`<br>`return res.redirect(next)` | `CWE-601` | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-006 open redirect controller return res req query next as string const -->
+| NST-007 | Hardcoded secrets in source | `const jwtSecret = "nest-prod-secret"` | `const jwtSecret = process.env.JWT_SECRET` | Node.js/NestJS | `CWE-798` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-007 hardcoded secrets source const jwtsecret nest prod secret process env jwt -->
+| NST-008 | JWT verify without algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ["HS256"] })` | Node.js/NestJS | `CWE-347` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-008 jwt verify without algorithm allowlist token secret algorithms hs256 -->
+| NST-009 | Missing body size limits | `app.use(express.json())` | `app.use(express.json({ limit: "1mb" }))` | Node.js/NestJS | `CWE-400` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-009 missing body size limits app use express json limit 1mb -->
+| NST-010 | Verbose exception leak | `catch (e) {`<br>`  throw new HttpException(e.message, 500)`<br>`}` | `catch (e) {`<br>`  logger.error(e)`<br>`  throw new HttpException("internal server error", 500)`<br>`}` | Node.js/NestJS | `CWE-209` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-010 verbose exception leak catch e throw new httpexception message 500 logger error internal server -->
+| NST-011 | Info leak in Swagger DTO | `class UserDto {`<br>`  password: string`<br>`}` | `class UserDto {`<br>`  @ApiHideProperty()`<br>`  password: string`<br>`}` | Node.js/NestJS | `CWE-200` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-011 info leak swagger dto class userdto password string apihideproperty -->
+| NST-012 | Unsafe implicit type conversion | `app.useGlobalPipes(new ValidationPipe({ transform: true, transformOptions: { enableImplicitConversion: true } }))` | `app.useGlobalPipes(new ValidationPipe({ transform: false, whitelist: true, forbidNonWhitelisted: true }))` | Node.js/NestJS | `CWE-915` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-012 unsafe implicit type conversion app useglobalpipes new validationpipe transform true transformoptions enableimplicitconversion false whitelist forbidnonwhitelisted -->
+| NST-013 | Raw HTML in template rendering | `return res.render("page", { userContent })`<br>`...`<br>`{{{ userContent }}}` | `return res.render("page", { userContent })`<br>`...`<br>`{{ userContent }}` | Node.js/NestJS | `CWE-79` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-013 raw html template rendering return res render page usercontent -->
+| NST-014 | SSRF in `HttpService` | `return this.httpService.get(url)` | `if (!ALLOWED_HOSTS.includes(hostname)) throw new ForbiddenException()`<br>`return this.httpService.get(url)` | Node.js/NestJS | `CWE-918` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-014 ssrf httpservice return this get url if allowed hosts includes hostname throw new forbiddenexception -->
+| NST-015 | Missing rate limiting in root module | `@Module({`<br>`  imports: [],`<br>`})` | `@Module({`<br>`  imports: [ThrottlerModule.forRoot([{ ttl: 60, limit: 20 }])],`<br>`})`<br>`app.useGlobalGuards(new ThrottlerGuard())` | Node.js/NestJS | `CWE-400` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-015 missing rate limiting root module imports throttlermodule forroot ttl 60 limit 20 app useglobalguards new throttlerguard -->
+| NST-016 | Insecure Reflector usage in Guard | `const roles = this.reflector.get("roles", context.getClass())` | `const roles = this.reflector.getAllAndOverride("roles", [context.getHandler(), context.getClass()])` | Node.js/NestJS | `CWE-285` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-016 insecure reflector usage guard const roles this get context getclass getallandoverride gethandler -->
+| NST-017 | File upload without magic number check | `@UseInterceptors(FileInterceptor("file"))`<br>`if (!file.originalname.endsWith(".png")) throw new BadRequestException()` | `const t = await fileTypeFromBuffer(file.buffer)`<br>`if (t?.mime !== "image/png") throw new BadRequestException()` | Node.js/NestJS | `CWE-20` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-017 file upload without magic number check useinterceptors fileinterceptor if originalname endswith png throw new badrequestexception const t await filetypefrombuffer buffer -->
+| NST-018 | Insecure bcrypt rounds | `const hash = await bcrypt.hash(pass, 1)` | `const hash = await bcrypt.hash(pass, 12)`<br>`...`<br>`const hash = await argon2.hash(pass)` | Node.js/NestJS | `CWE-327` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-018 insecure bcrypt rounds const hash await pass 1 12 argon2 -->
+| NST-019 | XXE risk in xml2js parsing | `await parseStringPromise(xmlData)` | `await parseStringPromise(xmlData, { explicitCharkey: false })`<br>`...`<br>`// external entity processors disabled` | Node.js/NestJS | `CWE-611` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-019 xxe risk xml2js parsing await parsestringpromise xmldata explicitcharkey false external entity processors disabled -->
+| NST-020 | Log Injection | `this.logger.log(userInput)` | `const safe = userInput.replace(/[\\r\\n]/g, "_")`<br>`this.logger.log(safe)` | Node.js/NestJS | `CWE-117` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-020 log injection this logger userinput const replace r n g -->
+| NST-021 | CSV Injection in Node/NestJS export handlers (CWE-1236) | `rows.push([user.email, req.query.note])` и raw `res.send(rows.join("\\n"))` | При CSV-экспорте экранировать formula prefixes (`=,+,-,@`) и использовать CSV writer library с sanitizer. | Node.js/NestJS | CWE Final Certification | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. |
+| NST-022 | Debug message disclosure in production exception filter (CWE-1295) | `response.status(500).json({ detail: exception.stack })` | Возвращать generic error message + incident id, stack trace оставлять только в restricted debug telemetry. | Node.js/NestJS | CWE Final Certification | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. |
+| NST-023 | CSV export from untrusted DTO fields without normalization (CWE-1236) | `csv += dto.name + "," + dto.comment + "\\n"` | Нормализовать/санитизировать DTO поля перед CSV serializing и принудительно quoted output для untrusted cells. | Node.js/NestJS | CWE Final Certification | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. |
+| NST-024 | `localStorage` с access/refresh токенами (CWE-312) | `localStorage.setItem("access_token", token)` | HttpOnly + Secure cookies или session storage с коротким TTL; не хранить bearer в Web Storage. | Node.js/Browser | `CWE-312` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-024 localstorage setitem access_token token guardian -->
+| NST-025 | PII в `localStorage` как JSON (CWE-312) | `localStorage.setItem("profile", JSON.stringify({ ssn: user.ssn }))` | Серверные сессии + минимизация PII; шифрование на клиенте только при threat model. | Node.js/Browser | `CWE-312` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-025 localstorage profile json stringify ssn guardian -->
+| NST-026 | Refresh token в `sessionStorage` без ротации (CWE-532) | `sessionStorage.setItem("refresh", refreshToken)` | BFF + HttpOnly cookie; rotation + bind к origin; не логировать storage в консоль. | Node.js/Browser | `CWE-532` | Validate data with Zod and sanitize DOM/HTML sinks with DOMPurify before rendering. | Атакующий доставляет входные данные, соответствующие anti-pattern; реальный ущерб зависит от приёмника (sink), конфигурации и границ доверия. | <!-- semantic_anchor: nst-026 sessionstorage refresh token guardian -->
+| NSX-101 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-102 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-103 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-104 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-105 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-106 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-107 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-108 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-109 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-110 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-111 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-112 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-113 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-114 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-115 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-116 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-117 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-118 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-119 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-120 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-121 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-122 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-123 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-124 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-125 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-126 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-127 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-128 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-129 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-130 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-131 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-132 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-133 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-134 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-135 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-136 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-137 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-138 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-139 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-140 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-141 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-142 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-143 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-144 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-145 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-146 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-147 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-148 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-149 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-150 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-151 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-152 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-153 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-154 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-155 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-156 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-157 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-158 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-159 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-160 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-161 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-162 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-163 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-164 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-165 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-166 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-167 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-168 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-169 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-170 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-171 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-172 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-173 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-174 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-175 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-176 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-177 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-178 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-179 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-180 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-181 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-182 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-183 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-184 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-185 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-186 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-187 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-188 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-189 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-190 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-191 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-192 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-193 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-194 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-195 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-196 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-197 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-198 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-199 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-200 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-201 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-202 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-203 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-204 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-205 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-206 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-207 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-208 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-209 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-210 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-211 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-212 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-213 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-214 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-215 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-216 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-217 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-218 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-219 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-220 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-221 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-222 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-223 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-224 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-225 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-226 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-227 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-228 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-229 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-230 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-231 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-232 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-233 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-234 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-235 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-236 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-237 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-238 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-239 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-240 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-241 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-242 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-243 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-244 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-245 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-246 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-247 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-248 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-249 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-250 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-251 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-252 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-253 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-254 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-255 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-256 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-257 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-258 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-259 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-260 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-261 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-262 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-263 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-264 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-265 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-266 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-267 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-268 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-269 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-270 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-271 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-272 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-273 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-274 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-275 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-276 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-277 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-278 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-279 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-280 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-281 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-282 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-283 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-284 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-285 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-286 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-287 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-288 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-289 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-290 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-291 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-292 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-293 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-294 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-295 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-296 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-297 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-298 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-299 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-300 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-301 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-302 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-303 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-304 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-305 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| NSX-306 | NestJS prototype pollution via Object.assign on DTO | `Object.assign(entity, req.body)` | `Object.assign(entity, pick(req.body, ['displayName','timezone']))` | Node.js/NestJS | CWE-1321 | Autofix: replace direct assign with allowlisted key mapping. | Polluted prototype chain can alter application object behavior. |
+| NSX-307 | Sandbox escape risk in vm module with untrusted code | `vm.runInNewContext(userScript, sandbox)` | `throw new Error('dynamic vm execution forbidden for untrusted input')` | Node.js/NestJS | CWE-94 | Autofix: block untrusted vm execution and move to fixed command dispatch. | Attacker-controlled script can escape context and execute host code. |
+| NSX-308 | JWT verification without strict algorithm allowlist | `jwt.verify(token, secret)` | `jwt.verify(token, secret, { algorithms: ['HS256'], issuer: 'hexvibe' })` | Node.js/NestJS | CWE-347 | Autofix: enforce explicit algorithms issuer and audience checks. | Algorithm confusion weakens token authenticity guarantees. |
+| NSX-309 | NestJS IDOR on route param (Logic: strong) | `return this.ordersRepo.findOneBy({ id: params.id })` | `return this.ordersRepo.findOneBy({ id: params.id, ownerId: user.id })` | Node.js/NestJS | CWE-639 | Autofix: bind object query to authenticated ownerId. | User can access arbitrary records by changing object identifier. |
+| NSX-310 | NestJS mass assignment through plainToInstance | `const entity = plainToInstance(UserEntity, dto)` | `const entity = plainToInstance(UserEntity, pick(dto, ['displayName','phone']))` | Node.js/NestJS | CWE-915 | Autofix: map DTO into explicit allowlist fields before entity binding. | Extra attacker-controlled fields become persisted security attributes. |
+| IFN-001 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-002 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-003 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-004 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-005 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-006 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-007 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-008 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-009 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-010 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-011 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-012 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-013 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-014 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-015 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-016 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-017 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-018 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-019 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-020 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-021 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-022 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-023 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-024 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-025 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-026 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-027 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-028 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-029 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-030 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-031 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-032 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-033 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-034 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-035 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-036 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-037 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-038 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-039 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-040 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-041 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-042 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-043 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-044 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-045 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-046 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-047 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |
+| IFN-048 | Node.js/NestJS: security config exists but not bound to endpoint chain (Logic: strong) | `http.authorizeHttpRequests(c -> c.anyRequest().permitAll())` | `http.authorizeHttpRequests(c -> c.requestMatchers('/admin/**').authenticated())` | Node.js/NestJS | CWE-863 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Declared security policy does not effectively protect controller paths. |
+| IFN-049 | Node.js/NestJS: missing global guard on controller route (Logic: strong) | `@GetMapping('/admin') public String admin(){ return svc.all(); }` | `@PreAuthorize('hasRole(''ADMIN'')') @GetMapping('/admin') public String admin(){ return svc.all(); }` | Node.js/NestJS | CWE-285 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Controller route is reachable without central authorization enforcement. |
+| IFN-050 | Node.js/NestJS: controller data access bypasses security context (Logic: strong) | `repo.findById(id)` | `repo.findByIdAndOwner(id, principalId)` | Node.js/NestJS | CWE-639 | Autofix: bind controller access to global guard/interceptor and owner-scoped repository methods. | Object fetched by id without principal binding enables BOLA/IDOR. |

package/dist/data/skills/nodejs-nestjs/skill.json

@@ -0,0 +1,24 @@
+{
+  "skill_id": "nodejs-nestjs",
+  "name": "Node.js / NestJS Security",
+  "activation_triggers": [
+    "nst-nest-guard",
+    "nst-prisma-raw",
+    "nst-cors-policy",
+    "nst-xml-parser",
+    "nst-ssrf-fetch"
+  ],
+  "relevant_extensions": [
+    ".ts",
+    ".js",
+    ".json"
+  ],
+  "tools": [
+    "semgrep",
+    "syft",
+    "trufflehog"
+  ],
+  "rules_path": "core/skills/nodejs-nestjs/patterns.md",
+  "few_shot_examples": "core/gold-standard-testbed/nestjs_vulnerable.ts",
+  "security_priority": 5
+}

package/dist/data/skills/observability/index.md

@@ -0,0 +1,68 @@
+# Observability & Audit Logging
+
+## Stack overview
+
+Structured logging, trace correlation, audit integrity, and security telemetry for Python services. Metrics are prefixed **`LOG`**.
+
+## Top threats
+
+- Silent failures and missing correlation (`LOG-001`–`LOG-003`, `LOG-010`).
+- PII/secrets in logs and verbose errors (`LOG-004`, `LOG-005`, `LOG-012`).
+- Missing audit for admin and auth events (`LOG-006`, `LOG-007`, `LOG-014`).
+- Log injection (`LOG-011`).
+
+## Pattern catalog
+
+Complete Anti-Pattern / Safe-Pattern definitions live in [`patterns.md`](patterns.md). The table below is a **table of contents** by metric ID.
+
+| ID | Metric | Stack |
+|---|---|---|
+| `LOG-001` | Silent Exception: `except Exception: pass` | `try:` `    await repo.save(event)` `except Exception:` `    logger.exception("audit-save-failed", extra={"event_type": event.type})` `    raise` |
+| `LOG-002` | Missing Trace-ID в логах запроса | `trace_id = request.headers.get("x-trace-id") or str(uuid4())` `logger.info("request accepted", extra={"trace_id": trace_id, "path": request.url.path})` `response.headers["X-Trace-ID"] = trace_id` |
+| `LOG-003` | Unstructured logs: текст без контекста безопасности | `logger.warning("auth_failed", extra={"trace_id": trace_id, "user": username, "ip": client_ip, "reason": "bad_credentials"})` |
+| `LOG-004` | PII/secret leakage in logs | `safe = {"username": payload.get("username"), "mfa": payload.get("mfa")}` `logger.info("auth payload sanitized", extra={"trace_id": trace_id, "payload": safe})` |
+| `LOG-005` | Verbose stack traces returned to API client | `except Exception:` `    logger.exception("unhandled error", extra={"trace_id": trace_id})` `    raise HTTPException(status_code=500, detail="internal server error")` |
+| `LOG-006` | Missing audit events for role/permission changes | `@app.post("/admin/users/{uid}/role")` `async def set_role(uid: int, role: str, actor=Depends(current_user)):` `    await repo.set_role(uid, role)` `    await audit_log.write({"event": "role_change", "actor_id": actor.id, "target_user_id": uid, "new_role": role, "trace_id": trace_id})` |
+| `LOG-007` | Missing failed-auth telemetry and lockout signals | `if not auth_ok:` `    await audit_log.write({"event": "auth_failed", "username": username, "ip": client_ip, "trace_id": trace_id})` `    await risk_counter.bump(f"auth:{username}:{client_ip}")` `    raise HTTPException(status_code=401, detail="invalid credentials")` |
+| `LOG-008` | No request/response latency telemetry | `@app.middleware("http")` `async def m(request: Request, call_next):` `    started = time.perf_counter()` `    response = await call_next(request)` `    elapsed_ms = (time.perf_counter() - started) * 1000` `    logger.info("http_access", extra={"trace_id": request.state.trace_id, "path": request.url.path, "status": response.status_code, "latency_ms": round(elapsed_ms, 2)})` `    return response` |
+| `LOG-009` | Logs without integrity controls/immutability for security events | `record = {"event": "payment_approved", "id": pid, "trace_id": trace_id, "ts": datetime.now(timezone.utc).isoformat()}` `record["sig"] = hmac_sha256(audit_signing_key, json.dumps(record, sort_keys=True))` `await append_only_audit_store.write(record)` |
+| `LOG-010` | No centralized exception handler for sanitization and correlation | `@app.exception_handler(Exception)` `async def handle_exc(request: Request, exc: Exception):` `    trace_id = getattr(request.state, "trace_id", "n/a")` `    logger.exception("unhandled", extra={"trace_id": trace_id, "path": request.url.path})` `    return JSONResponse(status_code=500, content={"detail": "internal server error", "trace_id": trace_id})` |
+| `LOG-011` | Log Injection Protection: CR/LF из пользовательских данных попадают в лог | `def sanitize_for_log(value: str) -> str:` `    return value.replace("\\r", "\\\\r").replace("\\n", "\\\\n")` `@app.get("/search")` `async def search(q: str):` `    safe_q = sanitize_for_log(q)` `    logger.info("search query=%s", safe_q)` `    return {"ok": True}` |
+| `LOG-012` | Sensitive Data in Exception Context: логирование `locals()` в prod | `except Exception:` `    logger.exception("failed", extra={"trace_id": trace_id, "context": {"operation": "payment_create"}})` `    raise` `# production logger must not capture locals or full frame dumps` |
+| `LOG-013` | Missing Security Heartbeat: нет периодических контрольных событий мониторинга | `async def security_heartbeat_task() -> None:` `    while True:` `        await audit_log.write({"event": "security_heartbeat", "service": "api", "status": "ok", "ts": datetime.now(timezone.utc).isoformat()})` `        await asyncio.sleep(60)` `@app.on_event("startup")` `async def start_heartbeat() -> None:` `    asyncio.create_task(security_heartbeat_task())` |
+| `LOG-014` | High-Privilege Action Audit: админ-действия пишутся в обычный app log | `@app.post("/admin/users/{uid}/disable")` `async def disable_user(uid: int, actor=Depends(current_user)):` `    logger.info("admin action requested", extra={"trace_id": trace_id, "actor_id": actor.id})` `    await security_audit_log.write({"event": "admin_user_disable", "actor_id": actor.id, "target_user_id": uid, "trace_id": trace_id, "ts": datetime.now(timezone.utc).isoformat()})` |
+| `LOG-015` | Системный лог: пароль в plaintext (`syslog`/journald) (CWE-312) | Structured logging + redaction filter для password fields. |
+| `LOG-016` | Docker/k8s: `env` секреты в stdout контейнера (CWE-532) | Log scrubber sidecar; deny `print(environ)` in prod. |
+| `LOG-017` | Windows Event Log: токен в `EventLog.WriteEntry` (CWE-312) | Token hash or presence flag only in EventLog. |
+| `LOG-018` | `journalctl`/structured log с Bearer в поле message (CWE-532) | Redact `Authorization`/`Cookie` keys globally. |
+| `LOG-019` | OpenTelemetry span: пароль в attributes (CWE-532) | OTel semantic conventions + scrubbing processor. |
+| `LOG-020` | Избыточное логирование полного HTTP-тела ответа с PII (CWE-779) | Sampling + redaction; max body length 0 in prod logs. |
+
+## Verification
+
+**Verification:** Check the gold testbed file(s) below for `Vulnerable: <ID>` markers (static Semgrep + `detection-matrix.md` ground truth).
+
+- [`gold-standard-testbed/api_vulnerable.py`](../gold-standard-testbed/api_vulnerable.py)
+
+**Optional HTTP integration tests** (pytest + httpx; require a running API, `HEXVIBE_TARGET_URL`): [`gold-standard-testbed/integration/verify_observability_poc.py`](../gold-standard-testbed/integration/verify_observability_poc.py). See [`gold-standard-testbed/integration/README.md`](../gold-standard-testbed/integration/README.md).
+
+After changing [`patterns.md`](patterns.md), run from the repo root:
+
+```bash
+python scripts/sync_semgrep.py
+```
+
+## Workflow: Recon → Scan → Verify
+
+### 1) Recon
+- Map entrypoints, data flows, and trust boundaries for this stack.
+- Identify which metrics in [`patterns.md`](patterns.md) apply to the code under review.
+
+### 2) Scan
+- Run Semgrep with `semgrep-rules/<skill>.yaml` (generated) and correlate with Anti-Patterns.
+- Eliminate findings that cannot bind to a metric row.
+
+### 3) Verify
+- Confirm markers or scanner hits for touched IDs in the gold testbed when adding metrics.
+- Emit findings as `Vulnerable: <PREFIX>-<NNN>` in written reviews.
+