Gaurav Kumar Gaurav8757

VAPT Report — DMT Module (src/modules/merchant/services/dmt)

Assessment Type: Vulnerability Assessment & Penetration Testing (White-box static + design review) Target: DMT (Domestic Money Transfer) client module and its transitive security dependencies Date: 2026-10-05 Reviewer: Kilo (automated source review) Reviewed Files: dmtSecureStorage.ts, services.ts, constants.ts, types.ts, index.ts, components/*.tsx, stores/useDmtBankStore.ts, dmt.e2e.spec.ts Supporting Infrastructure: src/lib/axios/axios-client.ts, src/lib/secureStorage.ts, src/modules/auth/stores/authState.ts, src/lib/logger.ts, next.config.ts

Redis Methods:

Single key-value pairs set/get karne ke liye use hota hai.

-- set/get => data store in string format

-- hset/hget/hgetall:

Data store in Object format
Used in store userProfile to get data fast not db calls and if any update invalidate data.

Approach 1: Client-side logout (Simple)

Token delete karo
Cookie clear karo
Small projects me common hai.

Approach 2: Token Blacklisting (Enterprise)

Logout ke time:

1. Create SSH key pair (Private & Public keys) using "ssh-keygen" on your local system.

1. Open Terminal

2. Run the following command:

ssh-keygen -t ed25519 -C "your_email@example.com"

If your system doesn’t support ed25519, use RSA:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

To use Sequelize ORM with Node.js for database operations including models, migrations, associations, queries, and transactions with PostgreSQL, MySQL, or SQLite.

It provides a clean API for database operations with support for migrations, associations, and transactions.

Installation

# Sequelize core

npm install sequelize

Foundation OF Redis

Database	Library	“new keyword”	Reason
MongoDB	Mongoose	❌ Required नहीं	`mongoose.connect()` खुद client बना देता है
MongoDB	Custom Mongoose	✔ Required	`const customMongoose = new mongoose.Mongoose();` आपको नया independent client चाहिए होता है
Redis	ioredis	✔ Required	`const redis = new Redis(); // <- NEW keyword required` Redis client एक class instance होता है
Redis	redis (legacy)	✔ Required	वही reason — class instance

ICONS8 IMAGE API

https://img.icons8.com/3d-fluency/200/touch-id.png

See Examples: -url: https://www.prisma.io/docs/prisma-orm/quickstart/postgresql

DIRECT_URL to create table (Migration)

DIRECT_URL="postgres://USER:PASSWORD@db.prisma.io:5432/postgres?sslmode=require"

DATABASE_URL to query with db (Queries)!

DATABASE_URL="postgres://USER:PASSWORD@pooled.db.prisma.io:5432/postgres?sslmode=require"

	// Node.js
	// >> PS F:\backend> node
	// Welcome to Node.js v24.18.0.
	// Type ".help" for more information.
	> global

	<ref *1> Object [global] {
	global: [Circular *1],
	clearImmediate: [Function: clearImmediate],
	setImmediate: [Function: setImmediate] {

	// Best approach:

	// OTP send API se initial TTL le lo.
	// Frontend me local countdown chalao.
	// Jab page refresh ho ya component remount ho tab TTL API hit karo.

	// Backend API

	// send otp
	app.post("/otp/send", async (req, res) => {