@boldsec/nestjs

Live BOLA/IDOR monitoring for NestJS. Add one interceptor; BoLD watches your API and raises an alarm the moment one user reaches another user's object, in real time, from your app's actual traffic.

• Metadata only. BoLD receives who made the request (an opaque, non-reversible handle, never the token), the endpoint shape, the object id, the status, and the object's declared owner if the response exposed one. The response body is read once to extract that single owner field and then discarded. No body, no headers, no credentials ever leave your app.
• Fail-safe. Shipping the metadata is fire-and-forget. If BoLD is slow or down, your response is returned untouched and on time. BoLD can never break or slow the app it watches.
• Never alters your response. Your handlers run exactly as before; responses are returned byte for byte. The interceptor observes HTTP requests only and passes everything else straight through.

Install

npm install @boldsec/nestjs

Requires @nestjs/common 9 or newer and rxjs 7 or newer (the Nest defaults).

Configure (once)

Add your keys from the BoLD Live page (shown once when you connect the app):

BOLD_INGEST_URL=https://<your-bold>/api/live/ingest
BOLD_INGEST_KEY=blk_...
# optional: owner-field names to look for in responses (default covers common ones)
BOLD_OWNER_FIELDS=ownerId,owner_id,user_id

Use

Register it as a global interceptor at bootstrap:

import { NestFactory } from "@nestjs/core";
import { boldNestInterceptor } from "@boldsec/nestjs";
import { AppModule } from "./app.module";

const app = await NestFactory.create(AppModule);

app.useGlobalInterceptors(boldNestInterceptor({
  resolveCallerId: (req) => req.user?.id ?? null, // same namespace as the owner field
}));

resolveCallerId tells BoLD which caller made the request, in the same namespace as your owner field (usually the authenticated user id). Return null when there is no authenticated caller. If you leave it out, BoLD still watches the route but reports the caller as unknown, which shows up as a loud "needs review", never a false all-clear.

Unconfigured (no BOLD_INGEST_URL), the interceptor is a transparent pass-through, so it is safe to leave wired in every environment.

What BoLD answers

One question: can one user reach another user's data or action? BoLD is a runtime alarm for the BOLA/IDOR ownership family, not a scanner. It confirms a real cross-user reach on live traffic and never guesses.

Learn more at boldsec.io.