42Crunch for NestJS

What middleBrick covers

Black-box scanning with no agents or SDK dependencies
Authentication bypass and JWT misconfiguration detection
BOLA, IDOR, BFLA, and privilege escalation probing
OpenAPI 3.x/2.0 contract and security scheme validation
LLM adversarial probing across multiple scan tiers
Continuous monitoring and diff-based alerting

API Security Posture for NestJS Applications

NestJS applications often expose REST and GraphQL endpoints with layered guards and interceptors. middleBrick performs black-box scanning against the running service, validating how effective existing guards are against bypass attempts. The scanner checks authentication schemes, JWT handling, CORS settings, and header hygiene to highlight deviations from secure defaults.

Authentication and Authorization Coverage

Authentication findings cover multi-method bypass attempts and JWT misconfigurations such as alg=none, weak HS256 keys, expired tokens, missing claims, and sensitive data present in payloads. Security headers and WWW-Authenticate compliance are also evaluated. Authorization checks include BOLA and IDOR through sequential ID enumeration and active adjacent-ID probing, alongside BFLA tests that probe admin endpoints and inspect role or permission field leakage.

Input Validation, Data Exposure, and Infrastructure Safety

Input validation checks detect CORS wildcard usage with and without credentials, dangerous HTTP methods, and debug endpoints. Data exposure findings identify PII patterns including email addresses, Luhn-validated card numbers, context-aware SSN formats, and API key formats for AWS, Stripe, GitHub, and Slack. Encryption checks verify HTTPS redirects, HSTS, cookie flags, and mixed content. SSRF probes target URL-accepting parameters and body fields, including active attempts to identify internal IPs and bypass mechanisms.

OpenAPI Contract Validation and LLM Security

The scanner parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution, cross-referencing spec definitions against runtime behavior to find undefined security schemes, sensitive fields, deprecated operations, and missing pagination. For LLM-facing endpoints, 18 adversarial probes across Quick, Standard, and Deep tiers assess system prompt extraction, instruction override, DAN and roleplay jailbreaks, data exfiltration, cost exploitation, encoding bypasses, translation-embedded injection, few-shot poisoning, markdown injection, multi-turn manipulation, indirect prompt injection, token smuggling, tool abuse, nested instruction injection, and PII extraction.

Authenticated Scanning Requirements and Safety Posture

Authenticated scanning supports Bearer, API key, Basic auth, and Cookie methods, requiring domain verification via DNS TXT record or HTTP well-known file to ensure only the domain owner can scan with credentials. The scanner forwards only an allowlist of headers including Authorization, X-API-Key, Cookie, and X-Custom-*. All scanning is read-only; destructive payloads are never sent. Private IPs, localhost, and cloud metadata endpoints are blocked at multiple layers. Data is deletable on demand and purged within 30 days of cancellation, and it is never sold or used for model training.

Frequently Asked Questions

Does middleBrick map findings to compliance frameworks for NestJS APIs?

The scanner maps findings to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). For other frameworks, it helps you prepare for and aligns with security controls described in relevant standards.

Can authenticated scans validate NestJS guard configurations?

Yes. Providing credentials allows the scanner to test how authentication and authorization mechanisms hold up against bypass attempts and privilege escalation paths specific to NestJS middleware and guards.

How does the scanner handle NestJS-generated error responses?

Error and stack trace leakage are evaluated for common NestJS error shapes, helping to identify unintended exposure of internal paths or debugging details in production responses.

What is the scope of LLM security testing for NestJS endpoints?

When LLM probes are enabled, the scanner runs 18 adversarial techniques across three scan tiers to assess prompt injection, jailbreak resilience, data exfiltration risks, and token-smuggling scenarios targeting API endpoints.

Can continuous monitoring detect regressions in NestJS API security?

Pro tier continuous monitoring supports scheduled rescans, diff detection for new and resolved findings, score drift tracking, email alerts, and HMAC-SHA256 signed webhooks to highlight changes in security posture.