Security is strongest when multiple controls work together. ZinTrust documents a 10-layer security architecture, with controls that live at different points in the request path. These are framework capabilities and patterns to configure—not a promise that every control is automatically active in every new app.

The documented architecture groups controls this way; the actual order and coverage depend on how each app registers middleware and handles authorization:

  1. Security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options)
  2. CORS origin validation and preflight handling
  3. Rate limiting (a 100 requests/minute baseline when configured; limits can be set per route)
  4. CSRF protection (double-submit cookie pattern)
  5. XSS sanitization
  6. Field-level sanitization on routes
  7. Schema validation before your handler runs
  8. Authentication (JWT verification, session validation)
  9. Authorization in your controllers (roles and ownership)
  10. SQL injection prevention through parameterized queries

Register middleware globally or on specific routes as appropriate, and implement authorization checks for your own roles and resource ownership. These controls reduce risk; they do not guarantee that an app is secure or that one missed check cannot lead to a breach.

Try it: npm install -g @zintrust/core && zin new my-app

Docs: https://zintrust.com/security
Source: https://github.com/ZinTrust/zintrust