domains / families / security / hunt-nestjs

hunt-nestjs

separate

Hunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift.

When to use

• Target uses NestJS (indicated by `x-powered-by: NestJS` or TypeScript decorator patterns in error messages).
• GraphQL endpoints exist alongside REST API.
• Microservice transports (TCP, Redis, NATS, MQTT, gRPC) are configured.
• Swagger/OpenAPI docs are exposed at `/api` or `/api-json`.
• CRUD endpoints follow predictable NestJS naming conventions.

Skill page

Source