Security Testing

Understand security testing techniques (SAST, DAST, SCA, pentest) and how to map the OWASP Top 10 2021 to a layered security testing strategy for Node.js.

Write automated SQL injection test payloads, verify Prisma parameterized queries block injection, detect injection with sqlmap, and test raw query safety.

Test for reflected and stored XSS, validate CSP headers, verify DOMPurify sanitization, and detect dangerous innerHTML patterns with Semgrep in React applications.

Test JWT token validation, session security, IDOR vulnerabilities, brute force protection, and MFA enforcement in NestJS APIs.

Test CORS headers for the wildcard+credentials misconfiguration, verify rate limiting effectiveness, and validate all security response headers in NestJS APIs.

Configure SCA pipelines using npm audit and Snyk, interpret CVSS scores, manage false positives with policy files, and set up Dependabot for automated security updates.

Configure Semgrep with OWASP rulesets, write custom security rules for NestJS/React patterns, and integrate ESLint security plugins for real-time vulnerability detection.

Run OWASP ZAP baseline, full, and API scan modes against staging, interpret reports, configure authenticated scans, and integrate ZAP into CI with false positive filtering.

Scan git history for leaked secrets with truffleHog, prevent commits with detect-secrets pre-commit hooks, and test that secrets are never exposed in API responses.

Test for SSRF vulnerabilities that reach internal services, verify insecure design patterns like email enumeration and unbounded queries, and implement defensive test patterns.

Use Burp Suite Community Edition for manual API security testing, follow the OWASP WSTG checklist, and document findings professionally with CVSS scores.

Integrate SAST, DAST, SCA, and secrets detection into a complete GitHub Actions security pipeline with stage-appropriate gates, unified PR reporting, and Slack alerting.