TypeScript / JavaScript Security Development Guide

Secure Development Lifecycle

Phase 1: Threat Modeling and Secure Design

• Identify trust boundaries — Map where untrusted data enters the system (HTTP requests, WebSocket messages, file uploads, database reads, environment variables, third-party APIs,

  postMessage

  , URL parameters, localStorage)
• Map data flows — Trace sensitive data (credentials, PII, tokens) through the system and verify protection at each stage
• Enumerate entry points — List all routes, endpoints, CLI arguments, message queue consumers, WebSocket handlers, and scheduled tasks
• Map attack surfaces to OWASP Top 10 — Cross-reference each entry point against the OWASP categories in the quick reference table below

• Centralized authentication and authorization middleware — never scatter auth checks across handlers
• Input validation at every trust boundary — validate early, reject invalid data before processing
• Least-privilege database access — use read-only connections where writes are not needed
• Defense in depth — layer multiple controls (input validation + parameterized queries + WAF)
• Fail securely — deny by default, require explicit grants
• Server-side enforcement — never rely solely on client-side validation or access controls

Phase 2: Secure Implementation

Critical Prohibitions

eval()

Function()

JSON.parse()

child_process.exec()

child_process.execFile()

spawn()

db.query(sql, params)

innerHTML

outerHTML

document.write()

textContent

dangerouslySetInnerHTML

Math.random()

crypto.randomUUID()

crypto.getRandomValues()

bcrypt

argon2

scrypt

crypto.scrypt()

==

===

Object.assign()

Object.create(null)

require()

import()

NODE_ENV !== 'production'

JSON.parse()

new RegExp(userInput)

vm.runInNewContext()

vm.runInThisContext()

rejectUnauthorized: false

Secure Implementation References

• For OWASP Top 10 details with vulnerable → secure code examples: See references/owasp-top-10.md
• For secure coding patterns organized by domain (input validation, auth, crypto, DOM security, subprocess, file I/O, web frameworks): See references/secure-coding.md

Phase 3: Security Verification

1. Static Analysis — Detect common vulnerability patterns automatically

   • eslint-plugin-security

     — Node.js security linter rules

   • eslint-plugin-no-unsanitized

     — Detect unsafe DOM manipulation

   • semgrep

     — Pattern-based analysis with OWASP and TypeScript/JavaScript rulesets

   • typescript-eslint

     — Type-aware linting for TypeScript
2. Dependency Audit — Identify known vulnerabilities in third-party packages

   • npm audit

     /

     yarn audit

     /

     pnpm audit

     — Built-in package manager auditing

   • snyk

     — Comprehensive vulnerability database and remediation advice

   • socket.dev

     — Supply chain attack detection (typosquatting, install scripts)
3. Secrets Detection — Find leaked credentials and API keys

   • detect-secrets

     — Baseline-aware secrets scanner

   • gitleaks

     — Git-aware secrets scanning
4. Code Review — Apply the security review workflow and checklists
5. Security Testing — Write negative tests that verify rejection of malicious inputs; fuzz-test parsers and validators

# ESLint security plugins
npm install --save-dev eslint-plugin-security eslint-plugin-no-unsanitized
npx eslint --ext .ts,.js,.tsx,.jsx src/

# npm audit — dependency vulnerabilities
npm audit
npm audit --audit-level=high

# Snyk — comprehensive dependency and code scanning
npx snyk test
npx snyk code test

# detect-secrets — secrets scanning
detect-secrets scan > .secrets.baseline

# Semgrep — advanced pattern matching
semgrep --config=p/javascript --config=p/typescript --config=p/owasp-top-ten src/

# Socket.dev — supply chain security
npx socket npm info <package-name>

Phase 4: Dependency and Deployment Security

Dependency Management

• Use lockfiles (

  package-lock.json

  ,

  yarn.lock

  ,

  pnpm-lock.yaml

  ) and commit them
• Run

  npm audit

  /

  snyk test

  in CI/CD pipeline on every build
• Enable

  --ignore-scripts

  for packages where postinstall scripts are not needed
• Monitor for typosquatting — verify package names carefully before installing
• Review new dependencies before adding — check maintainership, download counts, known issues
• Use

  socket.dev

  or similar tools to detect supply chain attacks (install scripts, obfuscated code)
• Prefer packages with provenance attestations (

  npm provenance

  )

Deployment Hardening

• Container security — Scan images with

  trivy

  ; use minimal base images (distroless, alpine); run as non-root user
• HTTPS/TLS — Enforce TLS 1.2+ for all connections; redirect HTTP to HTTPS; set

  Strict-Transport-Security

  header
• Security headers — Configure

  Content-Security-Policy

  ,

  X-Content-Type-Options: nosniff

  ,

  X-Frame-Options: DENY

  ,

  Permissions-Policy

• Secrets at runtime — Inject secrets via environment variables or mounted volumes; never bake into images or bundles
• Least privilege — Run processes as non-root; use read-only filesystems where possible; limit network access
• Source maps — Never deploy source maps to production in public-facing applications
• Client-side — Enable Subresource Integrity (SRI) for CDN scripts; configure strict CSP; avoid inline scripts
• Logging — Use structured logging (JSON); never log passwords, tokens, PII, or full stack traces to users; log authentication events and access denials for audit

OWASP Top 10:2025 Quick Reference

fetch(userUrl)

origin: *

path.resolve()

NODE_ENV=development

express.static()

.env

.env

npm audit

snyk

--ignore-scripts

socket.dev

Math.random()

crypto.randomUUID()

crypto.getRandomValues()

bcrypt

argon2

innerHTML

dangerouslySetInnerHTML

child_process.exec()

$gt

$ne

eval()

execFile()

spawn()

textContent

algorithm: "none"

algorithms: ["RS256"]

node-serialize

JSON.parse()

console.log

catch {}

finally

process.on('unhandledRejection')

Security Review Workflow

1. Scan for critical prohibitions — Check for any pattern in the "Critical Prohibitions" table above. Each match is an immediate high-severity finding.
2. Check input validation — Verify every entry point (route handler, CLI argument, file parser, WebSocket handler, queue consumer) validates and sanitizes input before processing.
3. Verify authentication and authorization — Confirm every endpoint requires authentication (unless explicitly public) and checks authorization for the specific resource being accessed.
4. Review data handling — Trace how secrets, PII, and sensitive data flow through the system. Verify encryption at rest and in transit, proper key management, and secure deletion. Ensure no secrets are bundled into client-side code.
5. Check error handling — Ensure errors do not leak stack traces, internal paths, database details, or configuration to users. Verify fail-secure behavior. Check for unhandled promise rejections.
6. Audit dependencies — Run

   npm audit

   and

   snyk test

   . Flag any unpatched dependencies or packages with known CVEs. Check for suspicious postinstall scripts.
7. Verify logging — Confirm no sensitive data (passwords, tokens, PII) appears in logs. Verify authentication events, authorization failures, and security-relevant actions are logged.
8. Run static analysis — Execute ESLint with security plugins and review findings. Run

   semgrep

   with JavaScript/TypeScript and OWASP rulesets for deeper analysis.
9. Check DOM security (client-side) — Verify no unsafe DOM manipulation (

   innerHTML

   ,

   document.write

   ). Check CSP configuration, SRI on external scripts, and proper sanitization of user content.
10. Report findings — For each finding, document: severity (Critical/High/Medium/Low), location (file:line), vulnerable code snippet, explanation of the risk, and recommended fix with code example.

Security Hardening Quick Commands

# === Static Analysis ===
npm install --save-dev eslint-plugin-security eslint-plugin-no-unsanitized
npx eslint --ext .ts,.js,.tsx,.jsx src/
semgrep --config=p/javascript --config=p/typescript --config=p/owasp-top-ten src/

# === Dependency Audit ===
npm audit --audit-level=high
npx snyk test

# === Secrets Detection ===
detect-secrets scan > .secrets.baseline
gitleaks detect --source .

# === Lock Dependencies ===
npm ci  # install from lockfile (CI/CD)

# === Container Scanning ===
# trivy image <image-name>

Reference Files

• references/owasp-top-10.md — Detailed OWASP Top 10 coverage with TypeScript/JavaScript-specific vulnerable → secure code examples for each category, including Express, Fastify, NestJS, Next.js, and React patterns
• references/secure-coding.md — Secure coding patterns organized by domain: input validation, authentication, cryptography, DOM security, subprocess execution, file operations, and web framework configuration (Express, Fastify, NestJS, Next.js, React)
• references/security-checklist.md — Actionable verification checklists for code review, architecture review, dependency audit, deployment hardening, security testing, and incident response