Does NestJS comes with security practices already?

Question

Does NestJS handles some security practices out of the box?. If not, what recommendations can you share to secure a NestJS application besides helmet? I see in the NestJS middleware docs an example using the helmet dependency.

When using TypeORM, SQL injection is covered?

Answer 1

Nest doesn't bring anything else than an actual HTTP provider used underneath (express/fastify). In order to stay flexible, we didn't decide to force anyone to use particular tools. Instead, you can choose whatever you want.

In terms of TypeORM, as far as I know, the SQL injection is prevented.