The Quiet Risk in How Most Banks Store Customer Documents, and How NestJS Handles It Properly

Short summary

Banks commonly store customer documents like government IDs in public storage buckets with never-expiring URLs, creating a silent security risk. The fix involves three layers: replacing public links with short-lived signed URLs, enforcing per-document ownership guards so even support agents can't access unrelated files, and logging every access event for audit compliance. The article provides NestJS code examples for each layer using AWS S3 presigned URLs, custom guards, and TypeORM audit entities.

• •Public, non-expiring storage URLs for sensitive documents are a widespread banking security flaw
• •Fix requires signed short-lived URLs, per-document ownership guards, and full access audit logging
• •NestJS code examples show S3 presigned URLs, custom CanActivate guards, and TypeORM access-log entities

Generated with AI, which can make mistakes.