Security is strongest when multiple controls work together. ZinTrust documents a 10-layer security architecture, with controls that live at different points in the request path. These are framework capabilities and patterns to configure—not a promise that every control is automatically active in every new app.
The documented architecture groups controls this way; the actual order and coverage depend on how each app registers middleware and handles authorization:
- Security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options)
- CORS origin validation and preflight handling
- Rate limiting (a 100 requests/minute baseline when configured; limits can be set per route)
- CSRF protection (double-submit cookie pattern)
- XSS sanitization
- Field-level sanitization on routes
- Schema validation before your handler runs
- Authentication (JWT verification, session validation)
- Authorization in your controllers (roles and ownership)
- SQL injection prevention through parameterized queries
Register middleware globally or on specific routes as appropriate, and implement authorization checks for your own roles and resource ownership. These controls reduce risk; they do not guarantee that an app is secure or that one missed check cannot lead to a breach.
Try it: npm install -g @zintrust/core && zin new my-app
Docs: https://zintrust.com/security
Source: https://github.com/ZinTrust/zintrust
