backend-security

Non-auth security for NestJS APIs on Fastify - OWASP API Top 10 mapping, security headers with @fastify/helmet, CORS allowlist, TLS at the edge, rate limiting with @nestjs/throttler and Redis, trustProxy, body and time limits, injection, SSRF, mass assignment, file uploads, secrets management and rotation, log and PII redaction, dependency and supply-chain hygiene, container hardening, SAST/DAST in CI, error message hygiene, and a per-endpoint review checklist. Load when hardening an API, adding uploads or outbound calls, configuring headers or limits, or reviewing an endpoint for security.