【2026年版】SaaSセキュリティチェックリスト：認証・データ保護・インシデント対応の実践ガイド

// Next.js + NextAuth.js による認証設定例
import NextAuth from "next-auth";
import { PrismaAdapter } from "@auth/prisma-adapter";
import Credentials from "next-auth/providers/credentials";
import Google from "next-auth/providers/google";
import { verify } from "argon2";

export const { handlers, signIn, signOut, auth } = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [
    Google({
      clientId: process.env.GOOGLE_CLIENT_ID,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    }),
    Credentials({
      credentials: {
        email: { type: "email" },
        password: { type: "password" },
        totpCode: { type: "text" },
      },
      async authorize(credentials) {
        const user = await prisma.user.findUnique({
          where: { email: credentials.email as string },
        });

        if (!user || !user.passwordHash) return null;

        // Argon2idでパスワード検証
        const isValid = await verify(
          user.passwordHash,
          credentials.password as string
        );
        if (!isValid) return null;

        // MFA検証（有効な場合）
        if (user.mfaEnabled) {
          const isValidTotp = verifyTOTP(
            user.mfaSecret,
            credentials.totpCode as string
          );
          if (!isValidTotp) return null;
        }

        return { id: user.id, email: user.email, role: user.role };
      },
    }),
  ],
  session: {
    strategy: "jwt",
    maxAge: 24 * 60 * 60, // 24時間
  },
  callbacks: {
    async jwt({ token, user }) {
      if (user) {
        token.role = user.role;
      }
      return token;
    },
    async session({ session, token }) {
      session.user.role = token.role;
      return session;
    },
  },
});

// Express.js RBAC ミドルウェアの実装例
import { Request, Response, NextFunction } from "express";

interface Permission {
  resource: string;
  action: "create" | "read" | "update" | "delete";
}

const rolePermissions: Record<string, Permission[]> = {
  admin: [
    { resource: "*", action: "create" },
    { resource: "*", action: "read" },
    { resource: "*", action: "update" },
    { resource: "*", action: "delete" },
  ],
  editor: [
    { resource: "articles", action: "create" },
    { resource: "articles", action: "read" },
    { resource: "articles", action: "update" },
    { resource: "comments", action: "read" },
    { resource: "comments", action: "delete" },
  ],
  viewer: [
    { resource: "articles", action: "read" },
    { resource: "comments", action: "read" },
  ],
};

function authorize(resource: string, action: Permission["action"]) {
  return (req: Request, res: Response, next: NextFunction) => {
    const userRole = req.user?.role;
    if (!userRole) {
      return res.status(401).json({ error: "Unauthorized" });
    }

    const permissions = rolePermissions[userRole] || [];
    const hasPermission = permissions.some(
      (p) =>
        (p.resource === resource || p.resource === "*") &&
        p.action === action
    );

    if (!hasPermission) {
      return res.status(403).json({ error: "Forbidden" });
    }

    next();
  };
}

// 使用例
app.get("/api/articles", authorize("articles", "read"), getArticles);
app.post("/api/articles", authorize("articles", "create"), createArticle);
app.delete("/api/articles/:id", authorize("articles", "delete"), deleteArticle);

// Node.js でのカラムレベル暗号化の実装
import { createCipheriv, createDecipheriv, randomBytes } from "crypto";

const ALGORITHM = "aes-256-gcm";
const KEY = Buffer.from(process.env.ENCRYPTION_KEY!, "hex"); // 32 bytes

interface EncryptedData {
  ciphertext: string;
  iv: string;
  tag: string;
}

function encrypt(plaintext: string): EncryptedData {
  const iv = randomBytes(16);
  const cipher = createCipheriv(ALGORITHM, KEY, iv);

  let ciphertext = cipher.update(plaintext, "utf8", "hex");
  ciphertext += cipher.final("hex");
  const tag = cipher.getAuthTag();

  return {
    ciphertext,
    iv: iv.toString("hex"),
    tag: tag.toString("hex"),
  };
}

function decrypt(encrypted: EncryptedData): string {
  const decipher = createDecipheriv(
    ALGORITHM,
    KEY,
    Buffer.from(encrypted.iv, "hex")
  );
  decipher.setAuthTag(Buffer.from(encrypted.tag, "hex"));

  let plaintext = decipher.update(encrypted.ciphertext, "hex", "utf8");
  plaintext += decipher.final("utf8");
  return plaintext;
}

// Prisma ミドルウェアでの透過的暗号化
prisma.$use(async (params, next) => {
  // 書き込み時に暗号化
  if (params.model === "User" && params.action === "create") {
    if (params.args.data.phoneNumber) {
      params.args.data.phoneNumber = JSON.stringify(
        encrypt(params.args.data.phoneNumber)
      );
    }
  }

  const result = await next(params);

  // 読み取り時に復号
  if (params.model === "User" && result?.phoneNumber) {
    result.phoneNumber = decrypt(JSON.parse(result.phoneNumber));
  }

  return result;
});

// Next.js のセキュリティヘッダー設定（next.config.js）
const securityHeaders = [
  {
    key: "Strict-Transport-Security",
    value: "max-age=63072000; includeSubDomains; preload",
  },
  {
    key: "X-Content-Type-Options",
    value: "nosniff",
  },
  {
    key: "X-Frame-Options",
    value: "DENY",
  },
  {
    key: "X-XSS-Protection",
    value: "1; mode=block",
  },
  {
    key: "Referrer-Policy",
    value: "strict-origin-when-cross-origin",
  },
  {
    key: "Permissions-Policy",
    value: "camera=(), microphone=(), geolocation=()",
  },
  {
    key: "Content-Security-Policy",
    value: [
      "default-src 'self'",
      "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
      "style-src 'self' 'unsafe-inline'",
      "img-src 'self' data: https:",
      "font-src 'self'",
      "connect-src 'self' https://api.example.com",
      "frame-ancestors 'none'",
      "base-uri 'self'",
      "form-action 'self'",
    ].join("; "),
  },
];

module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: securityHeaders,
      },
    ];
  },
};

// Winston + Datadog によるセキュリティログ設定
import winston from "winston";

const securityLogger = winston.createLogger({
  level: "info",
  format: winston.format.combine(
    winston.format.timestamp({ format: "ISO" }),
    winston.format.json()
  ),
  defaultMeta: {
    service: "my-saas-app",
    environment: process.env.NODE_ENV,
  },
  transports: [
    new winston.transports.File({
      filename: "logs/security.log",
      level: "warn",
    }),
    new winston.transports.Console(),
  ],
});

// セキュリティイベントの記録
function logSecurityEvent(event: {
  type: string;
  userId?: string;
  ip: string;
  details: Record<string, unknown>;
  severity: "low" | "medium" | "high" | "critical";
}) {
  securityLogger.warn("Security Event", {
    eventType: event.type,
    userId: event.userId,
    sourceIp: event.ip,
    details: event.details,
    severity: event.severity,
    timestamp: new Date().toISOString(),
  });

  // Critical イベントは即座にアラート
  if (event.severity === "critical") {
    sendAlert({
      channel: "security-alerts",
      message: `CRITICAL: ${event.type} from ${event.ip}`,
      details: event.details,
    });
  }
}

// 使用例：ログイン失敗の記録
app.post("/api/auth/login", async (req, res) => {
  try {
    const result = await authenticate(req.body);
    if (!result.success) {
      logSecurityEvent({
        type: "LOGIN_FAILURE",
        userId: req.body.email,
        ip: req.ip,
        details: { reason: result.reason, attempt: result.attemptCount },
        severity: result.attemptCount > 5 ? "high" : "medium",
      });
    }
    // ...
  } catch (error) {
    // ...
  }
});

# セキュアなDockerfileの例
FROM node:22-alpine AS builder

WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

COPY . .
RUN npm run build

# マルチステージビルドで最小イメージを作成
FROM node:22-alpine AS runner

# セキュリティアップデートの適用
RUN apk update && apk upgrade && apk add --no-cache dumb-init

# 非rootユーザーの作成
RUN addgroup -g 1001 -S appgroup && \
    adduser -S appuser -u 1001 -G appgroup

WORKDIR /app

# 本番用ファイルのみコピー
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:appgroup /app/package.json ./

# 非rootユーザーで実行
USER appuser

# ヘルスチェック
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

# dumb-initでPID 1問題を回避
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "dist/server.js"]

# GitHub Actions でのセキュリティスキャンパイプライン
name: Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 18 * * 1'  # 毎週月曜 3:00 JST

jobs:
  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run CodeQL analysis
        uses: github/codeql-action/init@v3
        with:
          languages: javascript-typescript

      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v3

  container-scan:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t my-app:scan .

      - name: Run Trivy container scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'my-app:scan'
          format: 'table'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}