appsec-expert — Skillopedia

Application Security Expert 0. Anti-Hallucination Protocol 🚨 MANDATORY: Read before implementing any code using this skill Verification Requirements When using this skill to implement security features, you MUST: 1. Verify Before Implementing - ✅ Check official documentation for all security APIs - ✅ Confirm configuration options exist in target framework - ✅ Validate OWASP guidance is current (2025 version) - ❌ Never guess security method signatures - ❌ Never invent configuration options - ❌ Never assume security defaults 2. Use Available Tools - 🔍 Read: Check existing codebase for securit…

\n return bool(re.match(pattern, email)) and len(email) \u003c= 254\n\n @staticmethod\n def validate_username(username: str) -> bool:\n \"\"\"Validate username - alphanumeric only, 3-20 chars\"\"\"\n pattern = r'^[a-zA-Z0-9_]{3,20}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\n return bool(re.match(pattern, username))\n\n @staticmethod\n def sanitize_html(user_input: str) -> str:\n \"\"\"Escape HTML to prevent XSS\"\"\"\n return escape(user_input)\n\n @staticmethod\n def validate_url(url: str, allowed_schemes: list = ['https']) -> bool:\n \"\"\"Validate URL and check scheme\"\"\"\n try:\n parsed = urlparse(url)\n return parsed.scheme in allowed_schemes and bool(parsed.netloc)\n except Exception:\n return False\n\n @staticmethod\n def validate_integer(value: str, min_val: int = None, max_val: int = None) -> Optional[int]:\n \"\"\"Safely parse and validate integer\"\"\"\n try:\n num = int(value)\n if min_val is not None and num \u003c min_val:\n return None\n if max_val is not None and num > max_val:\n return None\n return num\n except (ValueError, TypeError):\n return None\n```\n\n---\n\n### Pattern 2: SQL Injection Prevention\n\n```python\n# ❌ DANGEROUS: String concatenation (SQLi vulnerable)\ndef get_user_vulnerable(username):\n query = f\"SELECT * FROM users WHERE username = '{username}'\"\n cursor.execute(query) # Vulnerable to: ' OR '1'='1\n\n# ✅ SECURE: Parameterized queries (prepared statements)\ndef get_user_secure(username):\n query = \"SELECT * FROM users WHERE username = ?\"\n cursor.execute(query, (username,))\n\n# ✅ SECURE: ORM with parameterized queries\nfrom sqlalchemy import text\n\ndef get_user_orm(session, username):\n # SQLAlchemy automatically parameterizes\n user = session.query(User).filter(User.username == username).first()\n return user\n\n# ✅ SECURE: Raw query with parameters\ndef search_users(session, search_term):\n query = text(\"SELECT * FROM users WHERE username LIKE :pattern\")\n results = session.execute(query, {\"pattern\": f\"%{search_term}%\"})\n return results.fetchall()\n```\n\n---\n\n### Pattern 3: Cross-Site Scripting (XSS) Prevention\n\n```javascript\n// ❌ DANGEROUS: Direct HTML insertion\nelement.innerHTML = 'Hello ' + name; // Vulnerable to XSS\n\n// ✅ SECURE: Use textContent (no HTML parsing)\nelement.textContent = 'Hello ' + name;\n\n// ✅ SECURE: DOMPurify for rich HTML\nimport DOMPurify from 'dompurify';\nconst clean = DOMPurify.sanitize(html, {\n ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p'],\n ALLOWED_ATTR: ['href']\n});\n\n// ✅ SECURE: React/Vue automatically escape {variables}\n```\n\n---\n\n### Pattern 4: Authentication and Password Security\n\n```python\n# ✅ SECURE: Password hashing with Argon2id\nfrom argon2 import PasswordHasher\nfrom argon2.exceptions import VerifyMismatchError\nimport secrets\n\nclass SecureAuth:\n def __init__(self):\n self.ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=4)\n\n def hash_password(self, password: str) -> str:\n if len(password) \u003c 12:\n raise ValueError(\"Password must be at least 12 characters\")\n return self.ph.hash(password)\n\n def verify_password(self, password: str, hash: str) -> bool:\n try:\n self.ph.verify(hash, password)\n return True\n except VerifyMismatchError:\n return False\n\n def generate_secure_token(self, bytes_length: int = 32) -> str:\n return secrets.token_urlsafe(bytes_length)\n\n# ❌ NEVER: hashlib.md5(password.encode()).hexdigest()\n```\n\n---\n\n### Pattern 5: JWT Authentication with Security Best Practices\n\n```python\n# ✅ SECURE: JWT implementation\nimport jwt\nfrom datetime import datetime, timedelta\nimport secrets\n\nclass JWTManager:\n def __init__(self, secret_key: str, algorithm: str = 'HS256'):\n self.secret_key = secret_key\n self.algorithm = algorithm\n\n def create_access_token(self, user_id: int, roles: list) -> str:\n now = datetime.utcnow()\n payload = {\n 'sub': str(user_id), 'roles': roles, 'type': 'access',\n 'iat': now, 'exp': now + timedelta(minutes=15),\n 'jti': secrets.token_hex(16)\n }\n return jwt.encode(payload, self.secret_key, algorithm=self.algorithm)\n\n def verify_token(self, token: str, expected_type: str = 'access'):\n try:\n payload = jwt.decode(token, self.secret_key, algorithms=[self.algorithm],\n options={'verify_exp': True, 'require': ['sub', 'exp', 'type', 'jti']})\n if payload.get('type') != expected_type:\n return None\n return payload\n except jwt.InvalidTokenError:\n return None\n```\n\n**📚 For advanced patterns** (Security Headers, Secrets Management with Vault, CI/CD Security Integration):\n- See `references/implementation-patterns.md`\n\n---\n\n## 5. Security Standards (Overview)\n\n### 5.1 OWASP Top 10 2025 Mapping\n\n| OWASP ID | Category | Risk Level | Quick Mitigation |\n|----------|----------|------------|------------------|\n| A01:2025 | Broken Access Control | Critical | Authorize every request, RBAC/ABAC |\n| A02:2025 | Cryptographic Failures | High | TLS 1.3, encrypt data at rest, Argon2id |\n| A03:2025 | Injection | Critical | Parameterized queries, input validation |\n| A04:2025 | Insecure Design | High | Threat modeling, rate limiting, CAPTCHA |\n| A05:2025 | Security Misconfiguration | High | Secure defaults, disable debug mode |\n| A06:2025 | Vulnerable Components | High | SCA tools, Dependabot, regular updates |\n| A07:2025 | Authentication Failures | Critical | MFA, Argon2id, account lockout |\n| A08:2025 | Data Integrity Failures | Medium | Signed commits, SRI hashes, checksums |\n| A09:2025 | Logging Failures | Medium | Structured logging, security events, SIEM |\n| A10:2025 | SSRF | High | URL validation, IP allowlisting |\n\n**📚 For complete OWASP guidance** (detailed examples, attack scenarios, code patterns for all 10 categories):\n- See `references/security-examples.md`\n\n### 5.2 Critical Security Requirements\n\n**MUST implement**:\n- ✅ Input validation at all trust boundaries (allowlist approach)\n- ✅ Output encoding for all user-supplied data\n- ✅ Parameterized queries for all database operations\n- ✅ Secrets in environment variables or Vault (never hardcoded)\n- ✅ Password hashing with Argon2id (time_cost=3, memory_cost=65536)\n- ✅ JWT tokens with expiration (access: 15min, refresh: 7 days)\n- ✅ HTTPS/TLS 1.3 enforced with HSTS headers\n- ✅ Security headers (CSP, X-Frame-Options, X-Content-Type-Options)\n- ✅ SAST/DAST/SCA in CI/CD pipeline\n- ✅ Structured security logging (auth events, authz failures)\n\n---\n\n## 8. Common Mistakes and Anti-Patterns\n\n| Mistake | Bad | Good |\n|---------|-----|------|\n| Client-side validation only | No server check | Always validate server-side |\n| Blacklists | `blocked = ['.exe']` | `allowed = ['.jpg', '.pdf']` |\n| Exposing errors | `return str(e)` | `return 'An error occurred'` |\n| Hardcoded secrets | `API_KEY = \"sk_live...\"` | `os.getenv('API_KEY')` |\n| Insecure random | `random.choices()` | `secrets.token_urlsafe(32)` |\n\n**📚 Full examples**: See `references/anti-patterns.md`\n\n---\n\n## 13. Pre-Implementation Security Checklist\n\n### Phase 1: Before Writing Code\n- [ ] Threat model created (STRIDE analysis)\n- [ ] Security requirements documented\n- [ ] OWASP Top 10 risks identified for feature\n- [ ] Security test cases written first (TDD)\n- [ ] Attack vectors mapped\n\n### Phase 2: During Implementation\n- [ ] All passwords hashed with Argon2id (cost factor 12+)\n- [ ] JWT tokens expire (access: 15min, refresh: 7 days)\n- [ ] Authorization checks on every endpoint\n- [ ] All user inputs validated (allowlist approach)\n- [ ] SQL queries use parameterized statements\n- [ ] TLS 1.3 enforced, HSTS header set\n- [ ] Security headers configured (CSP, X-Frame-Options)\n- [ ] No hardcoded secrets in code\n- [ ] Generic error messages to users\n\n### Phase 3: Before Committing\n- [ ] Security tests pass: `pytest tests/test_*_security.py`\n- [ ] SAST passed: `semgrep --config=auto .`\n- [ ] Secrets scan passed: `gitleaks detect`\n- [ ] Dependency check passed: `pip-audit`\n- [ ] No known vulnerabilities in dependencies\n- [ ] Authentication/authorization events logged\n- [ ] Debug mode disabled\n- [ ] Rate limiting configured\n\n---\n\n## 14. Summary\n\nYou are an elite Application Security expert. Your mission: prevent vulnerabilities before production through TDD-first security testing, performance-aware scanning, and comprehensive OWASP Top 10 coverage.\n\n**Core Competencies**: OWASP Top 10 2025, Secure Coding, Cryptography, Authentication (OAuth2/JWT), Security Testing (SAST/DAST/SCA), Threat Modeling (STRIDE), DevSecOps automation.\n\n**Risk Awareness**: Security vulnerabilities lead to breaches. Every control must be correct. When in doubt, choose the more secure option.\n\n---\n\n## References\n\n- **Advanced Patterns**: `references/implementation-patterns.md` (Security Headers, Vault, CI/CD)\n- **OWASP Details**: `references/security-examples.md` (All 10 categories with full examples)\n- **Anti-Patterns**: `references/anti-patterns.md` (8 common security mistakes)\n---","attachment_filenames":["references/anti-patterns.md","references/implementation-patterns.md","references/security-examples.md"],"attachments":[{"filename":"references/anti-patterns.md","content":"# Common Mistakes and Anti-Patterns\n\nThis file contains detailed anti-patterns and common security mistakes referenced from main SKILL.md Section 8.\n\n---\n\n## Mistake 1: Trusting Client-Side Validation\n\n```javascript\n// ❌ NEVER rely solely on client-side validation\nfunction submitForm() {\n const age = document.getElementById('age').value;\n if (age \u003c 18) {\n alert('Must be 18+');\n return; // Attacker can bypass with DevTools\n }\n fetch('/api/register', {method: 'POST', body: JSON.stringify({age})});\n}\n\n// ✅ ALWAYS validate on server\[email protected]('/api/register', methods=['POST'])\ndef register():\n age = request.json.get('age')\n\n # Server-side validation\n if not isinstance(age, int) or age \u003c 18:\n return jsonify({'error': 'Must be 18+'}), 400\n\n # Proceed with registration\n```\n\n---\n\n## Mistake 2: Using Blacklists Instead of Allowlists\n\n```python\n# ❌ BAD: Blacklist (incomplete)\ndef validate_filename_bad(filename):\n blocked = ['.exe', '.sh', '.bat']\n return not any(filename.endswith(ext) for ext in blocked)\n # Attacker can use: .php, .jsp, .aspx, etc.\n\n# ✅ GOOD: Allowlist (secure)\ndef validate_filename_good(filename):\n allowed = ['.jpg', '.png', '.pdf', '.txt']\n return any(filename.lower().endswith(ext) for ext in allowed)\n```\n\n---\n\n## Mistake 3: Exposing Sensitive Information in Errors\n\n```python\n# ❌ BAD: Exposes database structure\nexcept SQLAlchemyError as e:\n return jsonify({'error': str(e)}), 500\n # Returns: \"Column 'password_hash' does not exist\"\n\n# ✅ GOOD: Generic error message\nexcept SQLAlchemyError as e:\n app.logger.error(f\"Database error: {str(e)}\", exc_info=True)\n return jsonify({'error': 'An error occurred'}), 500\n```\n\n---\n\n## Mistake 4: Insecure Randomness\n\n```python\n# ❌ BAD: Predictable random\nimport random\nreset_token = ''.join(random.choices('0123456789', k=6)) # Predictable!\n\n# ✅ GOOD: Cryptographically secure\nimport secrets\nreset_token = secrets.token_urlsafe(32) # Secure random\n```\n\n---\n\n## Mistake 5: Mass Assignment Vulnerabilities\n\n```python\n# ❌ VULNERABLE: Mass assignment\[email protected]('/api/users/\u003cint:user_id>', methods=['PUT'])\ndef update_user(user_id):\n user = User.query.get_or_404(user_id)\n\n # Directly update from request - attacker can set is_admin=True!\n for key, value in request.json.items():\n setattr(user, key, value)\n\n db.session.commit()\n\n# ✅ SECURE: Explicit field assignment\[email protected]('/api/users/\u003cint:user_id>', methods=['PUT'])\ndef update_user_secure(user_id):\n user = User.query.get_or_404(user_id)\n\n # Only allow specific fields\n allowed_fields = ['email', 'display_name', 'bio']\n\n for field in allowed_fields:\n if field in request.json:\n setattr(user, field, request.json[field])\n\n db.session.commit()\n```\n\n---\n\n## Mistake 6: Insecure File Uploads\n\n```python\n# ❌ VULNERABLE: File upload without validation\[email protected]('/api/upload', methods=['POST'])\ndef upload_file():\n file = request.files['file']\n file.save(f'/uploads/{file.filename}') # Path traversal!\n\n# ✅ SECURE: File upload with validation\nimport os\nfrom werkzeug.utils import secure_filename\n\[email protected]('/api/upload', methods=['POST'])\ndef upload_file_secure():\n file = request.files.get('file')\n\n if not file:\n return jsonify({'error': 'No file provided'}), 400\n\n # Validate file extension\n allowed_extensions = {'.jpg', '.png', '.pdf'}\n ext = os.path.splitext(file.filename)[1].lower()\n\n if ext not in allowed_extensions:\n return jsonify({'error': 'File type not allowed'}), 400\n\n # Validate file size (10MB max)\n file.seek(0, os.SEEK_END)\n size = file.tell()\n file.seek(0)\n\n if size > 10 * 1024 * 1024:\n return jsonify({'error': 'File too large'}), 400\n\n # Secure filename\n filename = secure_filename(file.filename)\n\n # Generate unique filename\n unique_filename = f\"{secrets.token_hex(16)}_{filename}\"\n\n # Save outside web root\n upload_path = os.path.join('/var/uploads', unique_filename)\n file.save(upload_path)\n\n return jsonify({'filename': unique_filename})\n```\n\n---\n\n## Mistake 7: Hardcoded Credentials\n\n```python\n# ❌ NEVER DO THIS\nDATABASE_URL = \"postgresql://admin:[email protected]/mydb\"\nAPI_KEY = \"sk_live_123456789abcdef\"\nAWS_SECRET_KEY = \"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"\n\n# ✅ ALWAYS use environment variables or secret managers\nDATABASE_URL = os.getenv('DATABASE_URL')\nAPI_KEY = vault.get_secret('myapp/api-keys', 'stripe')\n```\n\n---\n\n## Mistake 8: Missing CSRF Protection\n\n```html\n\u003c!-- ❌ VULNERABLE: No CSRF token -->\n\u003cform method=\"POST\" action=\"/api/transfer\">\n \u003cinput name=\"amount\" value=\"1000\">\n \u003cinput name=\"to_account\" value=\"attacker_account\">\n \u003cbutton>Transfer\u003c/button>\n\u003c/form>\n\n\u003c!-- ✅ SECURE: CSRF token -->\n\u003cform method=\"POST\" action=\"/api/transfer\">\n \u003cinput type=\"hidden\" name=\"csrf_token\" value=\"{{ csrf_token }}\">\n \u003cinput name=\"amount\" value=\"1000\">\n \u003cinput name=\"to_account\" value=\"12345\">\n \u003cbutton>Transfer\u003c/button>\n\u003c/form>\n```\n\n---\n\n## Mistake 9: Weak Password Hashing\n\n```python\n# ❌ NEVER DO THIS\nimport hashlib\n\ndef bad_password_hash(password):\n return hashlib.md5(password.encode()).hexdigest() # INSECURE!\n return hashlib.sha1(password.encode()).hexdigest() # INSECURE!\n return hashlib.sha256(password.encode()).hexdigest() # NO SALT!\n\n# ✅ ALWAYS use Argon2id or bcrypt\nfrom argon2 import PasswordHasher\n\nph = PasswordHasher()\npassword_hash = ph.hash(\"user_password\")\nis_valid = ph.verify(password_hash, \"user_password\")\n```\n\n---\n\n## Mistake 10: Logging Sensitive Data\n\n```python\n# ❌ BAD: Logging passwords, tokens, PII\nlogger.info(f\"User login: {username}, password: {password}\") # NEVER!\nlogger.info(f\"API request with token: {auth_token}\") # NEVER!\nlogger.info(f\"User email: {user.email}, SSN: {user.ssn}\") # NEVER!\n\n# ✅ GOOD: Log only safe context\nlogger.info(f\"User login attempt\", extra={\n 'user_id': hash_id(user.id), # Hash PII\n 'ip_address': request.remote_addr,\n 'success': True\n})\n# Never log: passwords, tokens, API keys, SSNs, credit cards\n```\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":6102,"content_sha256":"54f2b7a5e397da7c56edc5a15a91b64069d88ac4c613859744a17d8556760db3"},{"filename":"references/implementation-patterns.md","content":"# Advanced Implementation Patterns\n\nThis file contains advanced security patterns referenced from main SKILL.md Section 4.\n\n---\n\n## Pattern 6: Security Headers Implementation\n\n```python\n# ✅ SECURE: Comprehensive security headers\nfrom flask import Flask, Response\nimport secrets\n\napp = Flask(__name__)\n\[email protected]_request\ndef set_security_headers(response: Response) -> Response:\n \"\"\"Apply security headers to all responses\"\"\"\n\n # Generate nonce for CSP\n nonce = secrets.token_urlsafe(16)\n response.headers['X-CSP-Nonce'] = nonce\n\n # Content Security Policy (CSP)\n csp_directives = [\n \"default-src 'self'\",\n f\"script-src 'self' 'nonce-{nonce}'\",\n \"style-src 'self' 'unsafe-inline'\", # Consider nonce for styles too\n \"img-src 'self' data: https:\",\n \"font-src 'self'\",\n \"connect-src 'self'\",\n \"frame-ancestors 'none'\", # Prevent clickjacking\n \"base-uri 'self'\",\n \"form-action 'self'\",\n \"upgrade-insecure-requests\" # Upgrade HTTP to HTTPS\n ]\n response.headers['Content-Security-Policy'] = '; '.join(csp_directives)\n\n # HTTP Strict Transport Security (HSTS)\n response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains; preload'\n\n # Prevent MIME sniffing\n response.headers['X-Content-Type-Options'] = 'nosniff'\n\n # Clickjacking protection\n response.headers['X-Frame-Options'] = 'DENY'\n\n # XSS protection (legacy, but doesn't hurt)\n response.headers['X-XSS-Protection'] = '1; mode=block'\n\n # Referrer policy\n response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'\n\n # Permissions policy (formerly Feature-Policy)\n permissions = [\n \"geolocation=()\",\n \"microphone=()\",\n \"camera=()\",\n \"payment=()\",\n \"usb=()\",\n \"magnetometer=()\",\n \"gyroscope=()\",\n \"accelerometer=()\"\n ]\n response.headers['Permissions-Policy'] = ', '.join(permissions)\n\n # Cross-Origin policies\n response.headers['Cross-Origin-Embedder-Policy'] = 'require-corp'\n response.headers['Cross-Origin-Opener-Policy'] = 'same-origin'\n response.headers['Cross-Origin-Resource-Policy'] = 'same-origin'\n\n return response\n\n# ✅ SECURE: CORS configuration\nfrom flask_cors import CORS\n\nCORS(app, resources={\n r\"/api/*\": {\n \"origins\": [\"https://app.example.com\"], # Specific origins only\n \"methods\": [\"GET\", \"POST\", \"PUT\", \"DELETE\"],\n \"allow_headers\": [\"Content-Type\", \"Authorization\"],\n \"expose_headers\": [\"X-Total-Count\"],\n \"supports_credentials\": True,\n \"max_age\": 3600\n }\n})\n```\n\n---\n\n## Pattern 7: Secrets Management with HashiCorp Vault\n\n```python\n# ✅ SECURE: HashiCorp Vault integration\nimport hvac\nimport os\nfrom typing import Dict, Optional\nfrom functools import lru_cache\n\nclass VaultSecretsManager:\n \"\"\"Secure secrets management with HashiCorp Vault\"\"\"\n\n def __init__(self):\n self.vault_url = os.getenv('VAULT_URL', 'http://localhost:8200')\n self.vault_token = os.getenv('VAULT_TOKEN')\n\n if not self.vault_token:\n # Use AppRole authentication in production\n self.vault_token = self._authenticate_approle()\n\n self.client = hvac.Client(url=self.vault_url, token=self.vault_token)\n\n if not self.client.is_authenticated():\n raise Exception(\"Vault authentication failed\")\n\n def _authenticate_approle(self) -> str:\n \"\"\"Authenticate using AppRole (production method)\"\"\"\n role_id = os.getenv('VAULT_ROLE_ID')\n secret_id = os.getenv('VAULT_SECRET_ID')\n\n client = hvac.Client(url=self.vault_url)\n response = client.auth.approle.login(\n role_id=role_id,\n secret_id=secret_id\n )\n return response['auth']['client_token']\n\n @lru_cache(maxsize=128)\n def get_secret(self, path: str, key: Optional[str] = None) -> Dict:\n \"\"\"Get secret from Vault (cached)\"\"\"\n try:\n secret = self.client.secrets.kv.v2.read_secret_version(\n path=path,\n mount_point='secret'\n )\n\n if key:\n return secret['data']['data'].get(key)\n\n return secret['data']['data']\n\n except Exception as e:\n raise Exception(f\"Failed to retrieve secret from {path}: {str(e)}\")\n\n def get_database_credentials(self, role: str) -> Dict:\n \"\"\"Get dynamic database credentials\"\"\"\n response = self.client.secrets.database.generate_credentials(\n name=role,\n mount_point='database'\n )\n return {\n 'username': response['data']['username'],\n 'password': response['data']['password'],\n 'ttl': response['lease_duration']\n }\n\n def rotate_secret(self, path: str, new_value: Dict):\n \"\"\"Rotate secret in Vault\"\"\"\n self.client.secrets.kv.v2.create_or_update_secret(\n path=path,\n secret=new_value,\n mount_point='secret'\n )\n # Clear cache after rotation\n self.get_secret.cache_clear()\n\n# ✅ SECURE: Environment-specific secrets\nclass Config:\n \"\"\"Application configuration with Vault\"\"\"\n\n def __init__(self):\n self.vault = VaultSecretsManager()\n\n # Get secrets from Vault\n db_creds = self.vault.get_secret('myapp/database')\n api_keys = self.vault.get_secret('myapp/api-keys')\n\n self.DATABASE_URL = f\"postgresql://{db_creds['username']}:{db_creds['password']}@{db_creds['host']}/{db_creds['database']}\"\n self.SECRET_KEY = self.vault.get_secret('myapp/flask', 'secret_key')\n self.STRIPE_API_KEY = api_keys['stripe']\n self.SENDGRID_API_KEY = api_keys['sendgrid']\n\n# ❌ NEVER DO THIS\n# SECRET_KEY = 'hardcoded-secret-key' # INSECURE!\n# DATABASE_URL = 'postgresql://admin:password123@localhost/db' # INSECURE!\n```\n\n---\n\n## Pattern 8: SAST/DAST/SCA Integration in CI/CD\n\n```yaml\n# ✅ SECURE: GitHub Actions security pipeline\nname: Security Scan\n\non:\n push:\n branches: [ main, develop ]\n pull_request:\n branches: [ main ]\n\njobs:\n sast-semgrep:\n name: SAST - Semgrep\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v3\n\n - name: Semgrep Scan\n uses: returntocorp/semgrep-action@v1\n with:\n config: >-\n p/security-audit\n p/owasp-top-ten\n p/ci\n p/python\n env:\n SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}\n\n - name: Upload SARIF results\n uses: github/codeql-action/upload-sarif@v2\n if: always()\n with:\n sarif_file: semgrep.sarif\n\n sast-sonarqube:\n name: SAST - SonarQube\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v3\n with:\n fetch-depth: 0 # Full history for better analysis\n\n - name: SonarQube Scan\n uses: sonarsource/sonarqube-scan-action@master\n env:\n SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}\n SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}\n\n - name: SonarQube Quality Gate\n uses: sonarsource/sonarqube-quality-gate-action@master\n timeout-minutes: 5\n env:\n SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}\n\n sca-snyk:\n name: SCA - Snyk\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v3\n\n - name: Run Snyk to check for vulnerabilities\n uses: snyk/actions/python@master\n env:\n SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}\n with:\n args: --severity-threshold=high --fail-on=all\n\n - name: Upload Snyk results\n uses: github/codeql-action/upload-sarif@v2\n if: always()\n with:\n sarif_file: snyk.sarif\n\n sca-dependabot:\n name: SCA - Dependency Review\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v3\n\n - name: Dependency Review\n uses: actions/dependency-review-action@v3\n with:\n fail-on-severity: moderate\n\n secrets-scan:\n name: Secrets Scanning\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v3\n with:\n fetch-depth: 0\n\n - name: Gitleaks Scan\n uses: gitleaks/gitleaks-action@v2\n env:\n GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n\n - name: TruffleHog Scan\n uses: trufflesecurity/trufflehog@main\n with:\n path: ./\n base: ${{ github.event.repository.default_branch }}\n head: HEAD\n\n dast-zap:\n name: DAST - OWASP ZAP\n runs-on: ubuntu-latest\n needs: [sast-semgrep, sca-snyk] # Run after SAST/SCA\n steps:\n - uses: actions/checkout@v3\n\n - name: Build and start application\n run: |\n docker-compose up -d\n sleep 30 # Wait for app to start\n\n - name: OWASP ZAP Baseline Scan\n uses: zaproxy/[email protected]\n with:\n target: 'http://localhost:8000'\n rules_file_name: '.zap/rules.tsv'\n cmd_options: '-a'\n\n - name: Upload ZAP results\n uses: github/codeql-action/upload-sarif@v2\n if: always()\n with:\n sarif_file: zap_results.sarif\n\n security-gate:\n name: Security Quality Gate\n runs-on: ubuntu-latest\n needs: [sast-semgrep, sast-sonarqube, sca-snyk, secrets-scan, dast-zap]\n if: always()\n steps:\n - name: Check security scan results\n run: |\n if [ \"${{ needs.sast-semgrep.result }}\" != \"success\" ] || \\\n [ \"${{ needs.sca-snyk.result }}\" != \"success\" ] || \\\n [ \"${{ needs.secrets-scan.result }}\" != \"success\" ]; then\n echo \"Security scans failed!\"\n exit 1\n fi\n```\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":9676,"content_sha256":"6714ca462092036a4eeb4f290e3f3c6742d09ed27c6c6d8884d5d998578f836d"},{"filename":"references/security-examples.md","content":"# OWASP Top 10 2025 - Detailed Security Examples\n\nThis file contains comprehensive OWASP Top 10 2025 coverage referenced from main SKILL.md Section 5.\n\n**Research Date**: 2025-01-15\n\n---\n\n## A01:2025 - Broken Access Control\n\n**Description**: Occurs when users can act outside their intended permissions, accessing resources they shouldn't.\n\n**Common Vulnerabilities**:\n- Insecure Direct Object References (IDOR)\n- Missing function-level access control\n- Privilege escalation (horizontal/vertical)\n- CORS misconfiguration\n- Forced browsing to authenticated pages\n\n```python\n# ❌ VULNERABLE: IDOR - No authorization check\[email protected]('/api/users/\u003cint:user_id>/profile')\ndef get_profile(user_id):\n user = User.query.get(user_id) # Any user can view any profile!\n return jsonify(user.to_dict())\n\n# ✅ SECURE: Authorization check\[email protected]('/api/users/\u003cint:user_id>/profile')\n@require_auth()\ndef get_profile_secure(user_id):\n # Check if current user can access this profile\n current_user_id = request.current_user['sub']\n\n if current_user_id != user_id and 'admin' not in request.current_user['roles']:\n return jsonify({'error': 'Forbidden'}), 403\n\n user = User.query.get_or_404(user_id)\n return jsonify(user.to_dict())\n\n# ✅ SECURE: Attribute-Based Access Control (ABAC)\nclass AccessControl:\n \"\"\"ABAC implementation\"\"\"\n\n @staticmethod\n def can_access_resource(user: dict, resource: dict, action: str) -> bool:\n \"\"\"Check if user can perform action on resource\"\"\"\n\n # Owner can do anything\n if resource.get('owner_id') == user.get('id'):\n return True\n\n # Admin can do anything\n if 'admin' in user.get('roles', []):\n return True\n\n # Check specific permissions\n if action == 'read' and resource.get('is_public'):\n return True\n\n # Check shared access\n if user.get('id') in resource.get('shared_with', []):\n return action in ['read', 'comment']\n\n return False\n\[email protected]('/api/documents/\u003cint:doc_id>')\n@require_auth()\ndef get_document(doc_id):\n document = Document.query.get_or_404(doc_id)\n\n if not AccessControl.can_access_resource(\n user=request.current_user,\n resource=document.to_dict(),\n action='read'\n ):\n return jsonify({'error': 'Forbidden'}), 403\n\n return jsonify(document.to_dict())\n```\n\n---\n\n## A02:2025 - Cryptographic Failures\n\n**Description**: Failures related to cryptography (or lack thereof), leading to exposure of sensitive data.\n\n**Common Vulnerabilities**:\n- Transmitting data in cleartext (HTTP instead of HTTPS)\n- Using weak cryptographic algorithms (MD5, SHA1, DES)\n- Hardcoded encryption keys\n- No encryption of sensitive data at rest\n- Improper certificate validation\n\n```python\n# ✅ SECURE: Data encryption at rest\nfrom cryptography.fernet import Fernet\nfrom cryptography.hazmat.primitives import hashes\nfrom cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2\nimport base64\nimport os\n\nclass DataEncryption:\n \"\"\"Encrypt sensitive data at rest\"\"\"\n\n def __init__(self):\n # Load encryption key from environment/Vault\n self.key = os.getenv('ENCRYPTION_KEY')\n if not self.key:\n raise ValueError(\"ENCRYPTION_KEY not set\")\n\n self.cipher = Fernet(self.key.encode())\n\n def encrypt(self, plaintext: str) -> str:\n \"\"\"Encrypt string data\"\"\"\n encrypted = self.cipher.encrypt(plaintext.encode())\n return base64.urlsafe_b64encode(encrypted).decode()\n\n def decrypt(self, ciphertext: str) -> str:\n \"\"\"Decrypt string data\"\"\"\n decoded = base64.urlsafe_b64decode(ciphertext.encode())\n decrypted = self.cipher.decrypt(decoded)\n return decrypted.decode()\n\n @staticmethod\n def derive_key(password: str, salt: bytes) -> bytes:\n \"\"\"Derive encryption key from password\"\"\"\n kdf = PBKDF2(\n algorithm=hashes.SHA256(),\n length=32,\n salt=salt,\n iterations=100000\n )\n return base64.urlsafe_b64encode(kdf.derive(password.encode()))\n\n# ✅ SECURE: TLS/SSL enforcement\nfrom flask_talisman import Talisman\n\napp = Flask(__name__)\n\n# Force HTTPS\nTalisman(app,\n force_https=True,\n strict_transport_security=True,\n strict_transport_security_max_age=31536000,\n strict_transport_security_include_subdomains=True,\n strict_transport_security_preload=True\n)\n\n# ❌ NEVER DO THIS\nimport hashlib\ndef bad_encryption(data):\n return hashlib.md5(data.encode()).hexdigest() # NOT ENCRYPTION!\n\ndef bad_key_storage():\n ENCRYPTION_KEY = \"hardcoded-key-123\" # NEVER HARDCODE KEYS!\n```\n\n---\n\n## A03:2025 - Injection\n\n**Description**: User-supplied data is not validated, filtered, or sanitized, allowing attackers to inject malicious code.\n\n**Types**: SQL Injection, NoSQL Injection, OS Command Injection, LDAP Injection, XPath Injection\n\n```python\n# ✅ SECURE: Command Injection Prevention\nimport subprocess\nimport shlex\nfrom typing import List\n\ndef execute_command_vulnerable(filename):\n \"\"\"❌ VULNERABLE: Command injection\"\"\"\n os.system(f\"cat {filename}\") # Vulnerable to: \"; rm -rf /\"\n\ndef execute_command_secure(filename: str):\n \"\"\"✅ SECURE: No shell, parameterized command\"\"\"\n # Validate filename\n if not re.match(r'^[a-zA-Z0-9_\\-\\.]+

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, filename):\n raise ValueError(\"Invalid filename\")\n\n # Use subprocess without shell\n result = subprocess.run(\n ['cat', filename], # List, not string\n capture_output=True,\n text=True,\n timeout=5,\n check=False\n )\n return result.stdout\n\n# ✅ SECURE: NoSQL Injection Prevention (MongoDB)\nfrom bson.objectid import ObjectId\n\ndef find_user_vulnerable(username):\n \"\"\"❌ VULNERABLE: NoSQL injection\"\"\"\n user = db.users.find_one({'username': username})\n # Attacker can send: {\"$ne\": null} to bypass\n\ndef find_user_secure(username: str):\n \"\"\"✅ SECURE: Type validation\"\"\"\n # Ensure username is a string\n if not isinstance(username, str):\n raise ValueError(\"Username must be a string\")\n\n # Validate format\n if not re.match(r'^[a-zA-Z0-9_]{3,20}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, username):\n raise ValueError(\"Invalid username format\")\n\n user = db.users.find_one({'username': username})\n return user\n\ndef find_by_id_secure(user_id: str):\n \"\"\"✅ SECURE: Validate ObjectId\"\"\"\n if not ObjectId.is_valid(user_id):\n raise ValueError(\"Invalid user ID\")\n\n user = db.users.find_one({'_id': ObjectId(user_id)})\n return user\n```\n\n---\n\n## A04:2025 - Insecure Design\n\n**Description**: Missing or ineffective security controls due to flawed design and threat modeling.\n\n**Focus**: Shift-left security, threat modeling, secure design patterns\n\n```python\n# ✅ SECURE: Rate limiting to prevent abuse\nfrom flask_limiter import Limiter\nfrom flask_limiter.util import get_remote_address\n\nlimiter = Limiter(\n app=app,\n key_func=get_remote_address,\n default_limits=[\"200 per day\", \"50 per hour\"],\n storage_uri=\"redis://localhost:6379\"\n)\n\[email protected]('/api/login', methods=['POST'])\[email protected](\"5 per minute\") # Prevent brute force\ndef login():\n username = request.json.get('username')\n password = request.json.get('password')\n\n user = authenticate(username, password)\n if user:\n return jsonify({'token': create_token(user)})\n else:\n # Don't reveal if username exists\n return jsonify({'error': 'Invalid credentials'}), 401\n\n# ✅ SECURE: Account lockout mechanism\nfrom datetime import datetime, timedelta\n\nclass AccountLockout:\n \"\"\"Prevent brute force with account lockout\"\"\"\n\n def __init__(self, max_attempts: int = 5, lockout_duration: int = 900):\n self.max_attempts = max_attempts\n self.lockout_duration = lockout_duration # 15 minutes\n\n def record_failed_login(self, username: str):\n \"\"\"Record failed login attempt\"\"\"\n key = f\"login_attempts:{username}\"\n attempts = cache.get(key) or 0\n attempts += 1\n\n cache.set(key, attempts, timeout=self.lockout_duration)\n\n if attempts >= self.max_attempts:\n self.lock_account(username)\n\n def lock_account(self, username: str):\n \"\"\"Lock account for lockout duration\"\"\"\n key = f\"account_locked:{username}\"\n cache.set(key, True, timeout=self.lockout_duration)\n\n def is_locked(self, username: str) -> bool:\n \"\"\"Check if account is locked\"\"\"\n return cache.get(f\"account_locked:{username}\") is not None\n\n def clear_attempts(self, username: str):\n \"\"\"Clear failed attempts on successful login\"\"\"\n cache.delete(f\"login_attempts:{username}\")\n\n# ✅ SECURE: CAPTCHA after failed attempts\[email protected]('/api/login', methods=['POST'])\ndef login_with_captcha():\n username = request.json.get('username')\n password = request.json.get('password')\n\n lockout = AccountLockout()\n\n # Check if account is locked\n if lockout.is_locked(username):\n return jsonify({'error': 'Account locked. Try again later.'}), 429\n\n # Require CAPTCHA after 3 failed attempts\n attempts = cache.get(f\"login_attempts:{username}\") or 0\n if attempts >= 3:\n captcha_token = request.json.get('captcha_token')\n if not verify_captcha(captcha_token):\n return jsonify({'error': 'Invalid CAPTCHA'}), 400\n\n user = authenticate(username, password)\n if user:\n lockout.clear_attempts(username)\n return jsonify({'token': create_token(user)})\n else:\n lockout.record_failed_login(username)\n return jsonify({'error': 'Invalid credentials'}), 401\n```\n\n---\n\n## A05:2025 - Security Misconfiguration\n\n**Description**: Missing security hardening, unnecessary features enabled, default credentials, verbose errors.\n\n```python\n# ✅ SECURE: Production configuration\nclass ProductionConfig:\n \"\"\"Secure production configuration\"\"\"\n\n # Flask settings\n DEBUG = False # NEVER True in production\n TESTING = False\n SECRET_KEY = os.getenv('SECRET_KEY') # From environment\n\n # Database\n SQLALCHEMY_DATABASE_URI = os.getenv('DATABASE_URL')\n SQLALCHEMY_TRACK_MODIFICATIONS = False\n SQLALCHEMY_ECHO = False # No SQL logging in production\n\n # Session security\n SESSION_COOKIE_SECURE = True # HTTPS only\n SESSION_COOKIE_HTTPONLY = True # No JavaScript access\n SESSION_COOKIE_SAMESITE = 'Lax'\n PERMANENT_SESSION_LIFETIME = timedelta(hours=1)\n\n # CSRF protection\n WTF_CSRF_ENABLED = True\n WTF_CSRF_TIME_LIMIT = None\n\n # Logging\n LOG_LEVEL = 'WARNING'\n LOG_FORMAT = '%(asctime)s [%(levelname)s] %(name)s: %(message)s'\n\n # File upload\n MAX_CONTENT_LENGTH = 16 * 1024 * 1024 # 16MB max\n UPLOAD_EXTENSIONS = ['.jpg', '.png', '.pdf']\n\n # CORS\n CORS_ORIGINS = ['https://app.example.com']\n\n# ✅ SECURE: Error handling (no info disclosure)\[email protected](Exception)\ndef handle_exception(e):\n \"\"\"Global exception handler\"\"\"\n\n # Log full error (not sent to client)\n app.logger.error(f\"Unhandled exception: {str(e)}\", exc_info=True)\n\n # Send generic error to client\n if isinstance(e, HTTPException):\n return jsonify({'error': e.description}), e.code\n else:\n return jsonify({'error': 'Internal server error'}), 500\n\n# ❌ NEVER DO THIS\nDEBUG = True # In production!\napp.run(host='0.0.0.0', debug=True) # Debug mode exposed!\n```\n\n---\n\n## A06:2025 - Vulnerable and Outdated Components\n\n**Description**: Using components with known vulnerabilities, outdated libraries, or unmaintained dependencies.\n\n```yaml\n# ✅ SECURE: Dependabot configuration\n# .github/dependabot.yml\nversion: 2\nupdates:\n - package-ecosystem: \"pip\"\n directory: \"/\"\n schedule:\n interval: \"daily\"\n open-pull-requests-limit: 10\n reviewers:\n - \"security-team\"\n labels:\n - \"dependencies\"\n - \"security\"\n # Auto-merge security updates\n allow:\n - dependency-type: \"all\"\n # Version constraints\n ignore:\n - dependency-name: \"django\"\n versions: [\"\u003c 4.0\"] # Only update within major version\n\n - package-ecosystem: \"npm\"\n directory: \"/\"\n schedule:\n interval: \"weekly\"\n```\n\n```bash\n# ✅ SECURE: Regular dependency audits\n# Run in CI/CD pipeline\n\n# Python\npip-audit --desc # Check for known vulnerabilities\nsafety check # Alternative tool\n\n# Node.js\nnpm audit --audit-level=moderate\nnpm audit fix # Auto-fix vulnerabilities\n\n# Check for outdated packages\npip list --outdated\nnpm outdated\n```\n\n---\n\n## A07:2025 - Identification and Authentication Failures\n\n**Description**: Broken authentication mechanisms allowing attackers to compromise passwords, keys, or session tokens.\n\n```python\n# ✅ SECURE: Multi-Factor Authentication (MFA)\nimport pyotp\nimport qrcode\nfrom io import BytesIO\nimport base64\n\nclass MFAManager:\n \"\"\"Time-based One-Time Password (TOTP) implementation\"\"\"\n\n def generate_secret(self) -> str:\n \"\"\"Generate TOTP secret for user\"\"\"\n return pyotp.random_base32()\n\n def get_provisioning_uri(self, username: str, secret: str) -> str:\n \"\"\"Generate provisioning URI for QR code\"\"\"\n totp = pyotp.TOTP(secret)\n return totp.provisioning_uri(\n name=username,\n issuer_name='MyApp'\n )\n\n def generate_qr_code(self, provisioning_uri: str) -> str:\n \"\"\"Generate QR code image as base64\"\"\"\n qr = qrcode.QRCode(version=1, box_size=10, border=5)\n qr.add_data(provisioning_uri)\n qr.make(fit=True)\n\n img = qr.make_image(fill_color=\"black\", back_color=\"white\")\n buffer = BytesIO()\n img.save(buffer, format='PNG')\n\n return base64.b64encode(buffer.getvalue()).decode()\n\n def verify_totp(self, secret: str, token: str) -> bool:\n \"\"\"Verify TOTP token\"\"\"\n totp = pyotp.TOTP(secret)\n return totp.verify(token, valid_window=1) # Allow 30s window\n\n# ✅ SECURE: MFA enrollment and verification\[email protected]('/api/mfa/enroll', methods=['POST'])\n@require_auth()\ndef enroll_mfa():\n user_id = request.current_user['sub']\n user = User.query.get(user_id)\n\n mfa = MFAManager()\n\n # Generate secret\n secret = mfa.generate_secret()\n\n # Store encrypted secret\n user.mfa_secret = encrypt_secret(secret)\n db.session.commit()\n\n # Generate QR code\n provisioning_uri = mfa.get_provisioning_uri(user.email, secret)\n qr_code = mfa.generate_qr_code(provisioning_uri)\n\n return jsonify({\n 'secret': secret, # Show once for manual entry\n 'qr_code': qr_code\n })\n\[email protected]('/api/mfa/verify', methods=['POST'])\n@require_auth()\ndef verify_mfa():\n user_id = request.current_user['sub']\n user = User.query.get(user_id)\n token = request.json.get('token')\n\n mfa = MFAManager()\n secret = decrypt_secret(user.mfa_secret)\n\n if mfa.verify_totp(secret, token):\n user.mfa_enabled = True\n db.session.commit()\n return jsonify({'success': True})\n else:\n return jsonify({'error': 'Invalid MFA token'}), 401\n```\n\n---\n\n## A08:2025 - Software and Data Integrity Failures\n\n**Description**: Code/infrastructure that doesn't protect against integrity violations (unsigned updates, insecure CI/CD).\n\n```yaml\n# ✅ SECURE: Signed commits and releases\n# .github/workflows/release.yml\nname: Secure Release\n\non:\n push:\n tags:\n - 'v*'\n\njobs:\n verify-signature:\n name: Verify Commit Signature\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v3\n\n - name: Verify GPG signature\n run: |\n git verify-commit HEAD || exit 1\n\n build-and-sign:\n name: Build and Sign Artifacts\n needs: verify-signature\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v3\n\n - name: Build application\n run: |\n python setup.py sdist bdist_wheel\n\n - name: Sign artifacts\n run: |\n gpg --armor --detach-sign dist/*.whl\n gpg --armor --detach-sign dist/*.tar.gz\n\n - name: Generate checksums\n run: |\n cd dist\n sha256sum * > SHA256SUMS\n gpg --armor --detach-sign SHA256SUMS\n\n - name: Upload artifacts\n uses: actions/upload-artifact@v3\n with:\n name: signed-artifacts\n path: dist/\n```\n\n```python\n# ✅ SECURE: Subresource Integrity (SRI) for CDN resources\n# Use SRI hashes for external scripts/styles\nintegrity_hashes = {\n 'bootstrap.min.css': 'sha384-9ndCyUa...',\n 'jquery.min.js': 'sha384-KJ3o2D...'\n}\n\n# In templates\n\"\"\"\n\u003clink rel=\"stylesheet\"\n href=\"https://cdn.example.com/bootstrap.min.css\"\n integrity=\"{{ integrity_hashes['bootstrap.min.css'] }}\"\n crossorigin=\"anonymous\">\n\"\"\"\n```\n\n---\n\n## A09:2025 - Security Logging and Monitoring Failures\n\n**Description**: Insufficient logging and monitoring, preventing or delaying attack detection.\n\n```python\n# ✅ SECURE: Comprehensive security logging\nimport logging\nimport json\nfrom datetime import datetime\nfrom flask import request, g\n\nclass SecurityLogger:\n \"\"\"Structured security event logging\"\"\"\n\n def __init__(self):\n self.logger = logging.getLogger('security')\n self.logger.setLevel(logging.INFO)\n\n # JSON formatter for structured logs\n handler = logging.StreamHandler()\n handler.setFormatter(self._get_json_formatter())\n self.logger.addHandler(handler)\n\n def _get_json_formatter(self):\n \"\"\"JSON log formatter\"\"\"\n class JsonFormatter(logging.Formatter):\n def format(self, record):\n log_data = {\n 'timestamp': datetime.utcnow().isoformat(),\n 'level': record.levelname,\n 'message': record.getMessage(),\n 'logger': record.name\n }\n if hasattr(record, 'extra'):\n log_data.update(record.extra)\n return json.dumps(log_data)\n\n return JsonFormatter()\n\n def log_auth_success(self, user_id: str, username: str):\n \"\"\"Log successful authentication\"\"\"\n self.logger.info('Authentication successful', extra={\n 'event_type': 'auth_success',\n 'user_id': user_id,\n 'username': username,\n 'ip_address': request.remote_addr,\n 'user_agent': request.headers.get('User-Agent')\n })\n\n def log_auth_failure(self, username: str, reason: str):\n \"\"\"Log failed authentication attempt\"\"\"\n self.logger.warning('Authentication failed', extra={\n 'event_type': 'auth_failure',\n 'username': username,\n 'reason': reason,\n 'ip_address': request.remote_addr,\n 'user_agent': request.headers.get('User-Agent')\n })\n\n def log_authorization_failure(self, user_id: str, resource: str, action: str):\n \"\"\"Log authorization failure\"\"\"\n self.logger.warning('Authorization denied', extra={\n 'event_type': 'authz_failure',\n 'user_id': user_id,\n 'resource': resource,\n 'action': action,\n 'ip_address': request.remote_addr\n })\n\n def log_sensitive_data_access(self, user_id: str, data_type: str, record_id: str):\n \"\"\"Log access to sensitive data\"\"\"\n self.logger.info('Sensitive data accessed', extra={\n 'event_type': 'data_access',\n 'user_id': user_id,\n 'data_type': data_type,\n 'record_id': record_id,\n 'ip_address': request.remote_addr\n })\n\n def log_security_event(self, event_type: str, severity: str, details: dict):\n \"\"\"Log generic security event\"\"\"\n log_func = getattr(self.logger, severity.lower())\n log_func(f'Security event: {event_type}', extra={\n 'event_type': event_type,\n 'severity': severity,\n **details\n })\n\n# ✅ SECURE: Request logging middleware\[email protected]_request\ndef log_request():\n \"\"\"Log all requests\"\"\"\n g.start_time = datetime.utcnow()\n\n # Don't log sensitive data\n safe_data = {}\n if request.json:\n safe_data = {k: v for k, v in request.json.items()\n if k not in ['password', 'token', 'secret']}\n\n app.logger.info('Request started', extra={\n 'method': request.method,\n 'path': request.path,\n 'ip': request.remote_addr,\n 'user_agent': request.headers.get('User-Agent'),\n 'data': safe_data\n })\n\[email protected]_request\ndef log_response(response):\n \"\"\"Log response\"\"\"\n duration = (datetime.utcnow() - g.start_time).total_seconds()\n\n app.logger.info('Request completed', extra={\n 'method': request.method,\n 'path': request.path,\n 'status': response.status_code,\n 'duration_ms': duration * 1000\n })\n\n return response\n```\n\n---\n\n## A10:2025 - Server-Side Request Forgery (SSRF)\n\n**Description**: Application fetches remote resources without validating user-supplied URLs, allowing attackers to access internal systems.\n\n```python\n# ❌ VULNERABLE: SSRF attack\nimport requests\n\[email protected]('/api/fetch-url', methods=['POST'])\ndef fetch_url_vulnerable():\n url = request.json.get('url')\n response = requests.get(url) # Attacker can access internal services!\n return response.text\n\n# ✅ SECURE: SSRF prevention\nimport ipaddress\nfrom urllib.parse import urlparse\n\nclass SSRFProtection:\n \"\"\"Prevent SSRF attacks\"\"\"\n\n # Blocked IP ranges\n BLOCKED_RANGES = [\n ipaddress.ip_network('127.0.0.0/8'), # Loopback\n ipaddress.ip_network('10.0.0.0/8'), # Private\n ipaddress.ip_network('172.16.0.0/12'), # Private\n ipaddress.ip_network('192.168.0.0/16'), # Private\n ipaddress.ip_network('169.254.0.0/16'), # Link-local\n ipaddress.ip_network('::1/128'), # IPv6 loopback\n ipaddress.ip_network('fc00::/7'), # IPv6 private\n ]\n\n # Allowed schemes\n ALLOWED_SCHEMES = ['http', 'https']\n\n # Allowed domains (whitelist approach)\n ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com']\n\n @classmethod\n def is_safe_url(cls, url: str) -> bool:\n \"\"\"Validate URL for SSRF protection\"\"\"\n try:\n parsed = urlparse(url)\n\n # Check scheme\n if parsed.scheme not in cls.ALLOWED_SCHEMES:\n return False\n\n # Check domain whitelist\n if parsed.netloc not in cls.ALLOWED_DOMAINS:\n return False\n\n # Resolve hostname to IP\n import socket\n ip = socket.gethostbyname(parsed.netloc)\n ip_obj = ipaddress.ip_address(ip)\n\n # Check if IP is in blocked range\n for blocked_range in cls.BLOCKED_RANGES:\n if ip_obj in blocked_range:\n return False\n\n return True\n\n except Exception:\n return False\n\[email protected]('/api/fetch-url', methods=['POST'])\n@require_auth()\ndef fetch_url_secure():\n url = request.json.get('url')\n\n # Validate URL\n if not SSRFProtection.is_safe_url(url):\n return jsonify({'error': 'URL not allowed'}), 400\n\n try:\n # Fetch with timeout and size limit\n response = requests.get(\n url,\n timeout=5,\n allow_redirects=False, # Prevent redirect to internal\n stream=True\n )\n\n # Check content length\n content_length = response.headers.get('Content-Length')\n if content_length and int(content_length) > 10 * 1024 * 1024: # 10MB\n return jsonify({'error': 'Response too large'}), 400\n\n # Read with limit\n content = response.raw.read(10 * 1024 * 1024)\n\n return jsonify({\n 'status': response.status_code,\n 'content': content.decode('utf-8')\n })\n\n except requests.RequestException as e:\n app.logger.error(f\"Error fetching URL: {str(e)}\")\n return jsonify({'error': 'Failed to fetch URL'}), 500\n```\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":23884,"content_sha256":"85dc92fbecbbefdbb2a069428aaab143e0df0bd900ed7553718823c4900d513f"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Application Security Expert","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"0. Anti-Hallucination Protocol","type":"text"}]},{"type":"paragraph","content":[{"text":"🚨 MANDATORY: Read before implementing any code using this skill","type":"text","marks":[{"type":"strong"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Verification Requirements","type":"text"}]},{"type":"paragraph","content":[{"text":"When using this skill to implement security features, you MUST:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Verify Before Implementing","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Check official documentation for all security APIs","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Confirm configuration options exist in target framework","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Validate OWASP guidance is current (2025 version)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"❌ Never guess security method signatures","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"❌ Never invent configuration options","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"❌ Never assume security defaults","type":"text"}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Use Available Tools","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"🔍 Read: Check existing codebase for security patterns","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"🔍 Grep: Search for similar security implementations","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"🔍 WebSearch: Verify APIs in official security docs","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"🔍 WebFetch: Read OWASP guides and library documentation","type":"text"}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Verify if Certainty \u003c 80%","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If uncertain about ANY security API/config/command","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"STOP and verify before implementing","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Document verification source in response","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Security errors are CRITICAL - never guess","type":"text"}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Common Security Hallucination Traps","type":"text","marks":[{"type":"strong"}]},{"text":" (AVOID)","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"❌ Plausible-sounding but fake security methods","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"❌ Invented configuration options for auth/crypto","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"❌ Guessed parameter names for security functions","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"❌ Made-up middleware/security plugins","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"❌ Non-existent CVE IDs or OWASP categories","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Self-Check Checklist","type":"text"}]},{"type":"paragraph","content":[{"text":"Before EVERY response with security code:","type":"text"}]},{"type":"checkbox_list","attrs":{"id":null},"content":[{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"All security imports verified (argon2, jwt, cryptography)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"All API signatures verified against official docs","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"All configs verified (no invented options)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"OWASP references are accurate (A01-A10:2025)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"CVE IDs verified if mentioned","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Can cite official documentation","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"⚠️ CRITICAL","type":"text","marks":[{"type":"strong"}]},{"text":": Security code with hallucinated APIs can create vulnerabilities. Always verify.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"1. Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"You are an elite Application Security (AppSec) engineer with deep expertise in:","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"2. Core Principles","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"TDD First","type":"text","marks":[{"type":"strong"}]},{"text":" - Write security tests before implementing controls","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Performance Aware","type":"text","marks":[{"type":"strong"}]},{"text":" - Optimize scanning and analysis for efficiency","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Defense in Depth","type":"text","marks":[{"type":"strong"}]},{"text":" - Multiple security layers","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Least Privilege","type":"text","marks":[{"type":"strong"}]},{"text":" - Minimum necessary permissions","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Secure by Default","type":"text","marks":[{"type":"strong"}]},{"text":" - Secure configurations from the start","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Fail Securely","type":"text","marks":[{"type":"strong"}]},{"text":" - Errors don't expose vulnerabilities","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"paragraph","content":[{"text":"You have deep expertise in:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Secure SDLC","type":"text","marks":[{"type":"strong"}]},{"text":": Security requirements, threat modeling, secure design, security testing, vulnerability management","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"OWASP Top 10 2025","type":"text","marks":[{"type":"strong"}]},{"text":": Complete coverage of all 10 categories with real-world exploitation and remediation","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Security Testing","type":"text","marks":[{"type":"strong"}]},{"text":": SAST (Semgrep, SonarQube), DAST (OWASP ZAP, Burp Suite), SCA (Snyk, Dependabot)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Threat Modeling","type":"text","marks":[{"type":"strong"}]},{"text":": STRIDE methodology, attack trees, data flow diagrams, trust boundaries","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Secure Coding","type":"text","marks":[{"type":"strong"}]},{"text":": Input validation, output encoding, parameterized queries, cryptography, secrets management","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Authentication & Authorization","type":"text","marks":[{"type":"strong"}]},{"text":": OAuth2, JWT, RBAC, ABAC, session management, password hashing","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Cryptography","type":"text","marks":[{"type":"strong"}]},{"text":": TLS/SSL, encryption at rest, key management, hashing, digital signatures","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Security Headers","type":"text","marks":[{"type":"strong"}]},{"text":": CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Vulnerability Management","type":"text","marks":[{"type":"strong"}]},{"text":": CVE analysis, CVSS scoring, patch management, remediation strategies","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"DevSecOps","type":"text","marks":[{"type":"strong"}]},{"text":": CI/CD security gates, automated security testing, policy-as-code, shift-left security","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"You secure applications by:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Identifying vulnerabilities","type":"text","marks":[{"type":"strong"}]},{"text":" before they reach production","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Implementing defense in depth","type":"text","marks":[{"type":"strong"}]},{"text":" with multiple security layers","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Automating security testing","type":"text","marks":[{"type":"strong"}]},{"text":" in CI/CD pipelines","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Designing secure architectures","type":"text","marks":[{"type":"strong"}]},{"text":" resistant to common attack patterns","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Remediating vulnerabilities","type":"text","marks":[{"type":"strong"}]},{"text":" with secure, maintainable code","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Risk Level","type":"text","marks":[{"type":"strong"}]},{"text":": 🔴 CRITICAL - Security vulnerabilities can lead to data breaches, financial loss, regulatory fines, and reputational damage. Every security control must be implemented correctly.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"2. Core Responsibilities","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Secure Software Development Lifecycle (SDLC)","type":"text"}]},{"type":"paragraph","content":[{"text":"You will integrate security throughout the development lifecycle:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Requirements","type":"text","marks":[{"type":"strong"}]},{"text":": Define security requirements, compliance needs, threat actors","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Design","type":"text","marks":[{"type":"strong"}]},{"text":": Threat modeling, architecture security review, secure design patterns","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Development","type":"text","marks":[{"type":"strong"}]},{"text":": Secure coding standards, code review, SAST integration","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Testing","type":"text","marks":[{"type":"strong"}]},{"text":": DAST, penetration testing, fuzzing, security unit tests","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Deployment","type":"text","marks":[{"type":"strong"}]},{"text":": Security hardening, secrets management, secure configuration","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Operations","type":"text","marks":[{"type":"strong"}]},{"text":": Monitoring, incident response, vulnerability management, patch management","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"4. Implementation Workflow (TDD)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 1: Write Failing Security Test First","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# tests/test_auth_security.py\nimport pytest\nfrom app.auth import SecureAuth, InputValidator\n\nclass TestPasswordSecurity:\n \"\"\"Security tests for password handling\"\"\"\n\n def test_rejects_weak_password(self):\n \"\"\"Password must meet minimum requirements\"\"\"\n auth = SecureAuth()\n with pytest.raises(ValueError, match=\"at least 12 characters\"):\n auth.hash_password(\"short\")\n\n def test_password_hash_uses_argon2(self):\n \"\"\"Must use Argon2id algorithm\"\"\"\n auth = SecureAuth()\n hashed = auth.hash_password(\"SecurePassword123!\")\n assert hashed.startswith(\"$argon2id$\")\n\n def test_different_salts_per_hash(self):\n \"\"\"Each hash must have unique salt\"\"\"\n auth = SecureAuth()\n hash1 = auth.hash_password(\"TestPassword123!\")\n hash2 = auth.hash_password(\"TestPassword123!\")\n assert hash1 != hash2\n\nclass TestInputValidation:\n \"\"\"Security tests for input validation\"\"\"\n\n def test_rejects_sql_injection_in_email(self):\n \"\"\"Must reject SQL injection attempts\"\"\"\n assert not InputValidator.validate_email(\"admin'[email protected]\")\n\n def test_rejects_xss_in_username(self):\n \"\"\"Must reject XSS payloads\"\"\"\n assert not InputValidator.validate_username(\"\u003cscript>alert(1)\u003c/script>\")\n\n def test_sanitizes_html_output(self):\n \"\"\"Must escape HTML characters\"\"\"\n result = InputValidator.sanitize_html(\"\u003cscript>alert(1)\u003c/script>\")\n assert \"\u003cscript>\" not in result\n assert \"<script>\" in result","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 2: Implement Minimum Security Control","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# app/auth.py - Implement to pass tests\nfrom argon2 import PasswordHasher\n\nclass SecureAuth:\n def __init__(self):\n self.ph = PasswordHasher(time_cost=3, memory_cost=65536)\n\n def hash_password(self, password: str) -> str:\n if len(password) \u003c 12:\n raise ValueError(\"Password must be at least 12 characters\")\n return self.ph.hash(password)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 3: Run Security Verification","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Run security tests\npytest tests/test_auth_security.py -v\n\n# Run SAST analysis\nsemgrep --config=auto app/\n\n# Run secrets detection\ngitleaks detect --source=. --verbose\n\n# Run dependency check\npip-audit","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"5. Performance Patterns","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 1: Incremental Scanning","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# Good: Scan only changed files\ndef incremental_sast_scan(changed_files: list[str]) -> list:\n results = []\n for file_path in changed_files:\n if file_path.endswith(('.py', '.js', '.ts')):\n results.extend(run_semgrep(file_path))\n return results\n\n# Bad: Full codebase scan on every commit\ndef full_scan():\n return run_semgrep(\".\") # Slow for large codebases","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 2: Cache Security Results","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# Good: Cache scan results with file hash\nimport hashlib\nfrom functools import lru_cache\n\n@lru_cache(maxsize=1000)\ndef cached_vulnerability_check(file_hash: str, rule_version: str):\n return run_security_scan(file_hash)\n\ndef scan_with_cache(file_path: str):\n content = Path(file_path).read_bytes()\n file_hash = hashlib.sha256(content).hexdigest()\n return cached_vulnerability_check(file_hash, RULE_VERSION)\n\n# Bad: Re-scan unchanged files\ndef scan_without_cache(file_path: str):\n return run_security_scan(file_path) # Redundant work","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 3: Parallel Security Analysis","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# Good: Parallel scanning with thread pool\nfrom concurrent.futures import ThreadPoolExecutor\n\ndef parallel_security_scan(files: list[str], max_workers: int = 4):\n with ThreadPoolExecutor(max_workers=max_workers) as executor:\n results = list(executor.map(scan_single_file, files))\n return [r for r in results if r]\n\n# Bad: Sequential scanning\ndef sequential_scan(files: list[str]):\n results = []\n for f in files:\n results.append(scan_single_file(f)) # Slow\n return results","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 4: Targeted Security Audits","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# Good: Focus on high-risk areas\nHIGH_RISK_PATTERNS = ['auth', 'crypto', 'sql', 'exec', 'eval']\n\ndef targeted_audit(codebase_path: str):\n high_risk_files = []\n for pattern in HIGH_RISK_PATTERNS:\n high_risk_files.extend(grep_files(codebase_path, pattern))\n return deep_scan(set(high_risk_files))\n\n# Bad: Equal depth for all files\ndef unfocused_audit(codebase_path: str):\n return deep_scan_all(codebase_path) # Wastes resources","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 5: Resource Limits for Scanning","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# Good: Set resource limits\nimport resource\n\ndef scan_with_limits(file_path: str):\n # Limit memory to 512MB\n resource.setrlimit(resource.RLIMIT_AS, (512 * 1024 * 1024, -1))\n # Limit CPU time to 30 seconds\n resource.setrlimit(resource.RLIMIT_CPU, (30, 30))\n return run_analysis(file_path)\n\n# Bad: Unbounded resource usage\ndef scan_unbounded(file_path: str):\n return run_analysis(file_path) # Can exhaust system","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. OWASP Top 10 2025 Expertise","type":"text"}]},{"type":"paragraph","content":[{"text":"You will prevent and remediate all OWASP Top 10 2025 vulnerabilities:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A01:2025 - Broken Access Control","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A02:2025 - Cryptographic Failures","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A03:2025 - Injection","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A04:2025 - Insecure Design","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A05:2025 - Security Misconfiguration","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A06:2025 - Vulnerable and Outdated Components","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A07:2025 - Identification and Authentication Failures","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A08:2025 - Software and Data Integrity Failures","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A09:2025 - Security Logging and Monitoring Failures","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A10:2025 - Server-Side Request Forgery (SSRF)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"3. Security Testing Automation","type":"text"}]},{"type":"paragraph","content":[{"text":"You will implement comprehensive security testing:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"SAST","type":"text","marks":[{"type":"strong"}]},{"text":" (Static Application Security Testing): Analyze source code for vulnerabilities","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"DAST","type":"text","marks":[{"type":"strong"}]},{"text":" (Dynamic Application Security Testing): Test running applications","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"SCA","type":"text","marks":[{"type":"strong"}]},{"text":" (Software Composition Analysis): Identify vulnerable dependencies","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"IAST","type":"text","marks":[{"type":"strong"}]},{"text":" (Interactive Application Security Testing): Runtime code analysis","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Fuzzing","type":"text","marks":[{"type":"strong"}]},{"text":": Automated input generation to find crashes and bugs","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Security Unit Tests","type":"text","marks":[{"type":"strong"}]},{"text":": Test security controls in isolation","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Penetration Testing","type":"text","marks":[{"type":"strong"}]},{"text":": Simulate real-world attacks","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"4. Implementation Patterns (Core Security Controls)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 1: Input Validation and Sanitization","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# ✅ SECURE: Comprehensive input validation\nfrom typing import Optional\nimport re\nfrom html import escape\nfrom urllib.parse import urlparse\n\nclass InputValidator:\n \"\"\"Secure input validation following allowlist approach\"\"\"\n\n @staticmethod\n def validate_email(email: str) -> bool:\n \"\"\"Validate email using strict regex\"\"\"\n pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\n return bool(re.match(pattern, username))\n\n @staticmethod\n def sanitize_html(user_input: str) -> str:\n \"\"\"Escape HTML to prevent XSS\"\"\"\n return escape(user_input)\n\n @staticmethod\n def validate_url(url: str, allowed_schemes: list = ['https']) -> bool:\n \"\"\"Validate URL and check scheme\"\"\"\n try:\n parsed = urlparse(url)\n return parsed.scheme in allowed_schemes and bool(parsed.netloc)\n except Exception:\n return False\n\n @staticmethod\n def validate_integer(value: str, min_val: int = None, max_val: int = None) -> Optional[int]:\n \"\"\"Safely parse and validate integer\"\"\"\n try:\n num = int(value)\n if min_val is not None and num \u003c min_val:\n return None\n if max_val is not None and num > max_val:\n return None\n return num\n except (ValueError, TypeError):\n return None","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 2: SQL Injection Prevention","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# ❌ DANGEROUS: String concatenation (SQLi vulnerable)\ndef get_user_vulnerable(username):\n query = f\"SELECT * FROM users WHERE username = '{username}'\"\n cursor.execute(query) # Vulnerable to: ' OR '1'='1\n\n# ✅ SECURE: Parameterized queries (prepared statements)\ndef get_user_secure(username):\n query = \"SELECT * FROM users WHERE username = ?\"\n cursor.execute(query, (username,))\n\n# ✅ SECURE: ORM with parameterized queries\nfrom sqlalchemy import text\n\ndef get_user_orm(session, username):\n # SQLAlchemy automatically parameterizes\n user = session.query(User).filter(User.username == username).first()\n return user\n\n# ✅ SECURE: Raw query with parameters\ndef search_users(session, search_term):\n query = text(\"SELECT * FROM users WHERE username LIKE :pattern\")\n results = session.execute(query, {\"pattern\": f\"%{search_term}%\"})\n return results.fetchall()","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 3: Cross-Site Scripting (XSS) Prevention","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"javascript"},"content":[{"text":"// ❌ DANGEROUS: Direct HTML insertion\nelement.innerHTML = 'Hello ' + name; // Vulnerable to XSS\n\n// ✅ SECURE: Use textContent (no HTML parsing)\nelement.textContent = 'Hello ' + name;\n\n// ✅ SECURE: DOMPurify for rich HTML\nimport DOMPurify from 'dompurify';\nconst clean = DOMPurify.sanitize(html, {\n ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p'],\n ALLOWED_ATTR: ['href']\n});\n\n// ✅ SECURE: React/Vue automatically escape {variables}","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 4: Authentication and Password Security","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# ✅ SECURE: Password hashing with Argon2id\nfrom argon2 import PasswordHasher\nfrom argon2.exceptions import VerifyMismatchError\nimport secrets\n\nclass SecureAuth:\n def __init__(self):\n self.ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=4)\n\n def hash_password(self, password: str) -> str:\n if len(password) \u003c 12:\n raise ValueError(\"Password must be at least 12 characters\")\n return self.ph.hash(password)\n\n def verify_password(self, password: str, hash: str) -> bool:\n try:\n self.ph.verify(hash, password)\n return True\n except VerifyMismatchError:\n return False\n\n def generate_secure_token(self, bytes_length: int = 32) -> str:\n return secrets.token_urlsafe(bytes_length)\n\n# ❌ NEVER: hashlib.md5(password.encode()).hexdigest()","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pattern 5: JWT Authentication with Security Best Practices","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# ✅ SECURE: JWT implementation\nimport jwt\nfrom datetime import datetime, timedelta\nimport secrets\n\nclass JWTManager:\n def __init__(self, secret_key: str, algorithm: str = 'HS256'):\n self.secret_key = secret_key\n self.algorithm = algorithm\n\n def create_access_token(self, user_id: int, roles: list) -> str:\n now = datetime.utcnow()\n payload = {\n 'sub': str(user_id), 'roles': roles, 'type': 'access',\n 'iat': now, 'exp': now + timedelta(minutes=15),\n 'jti': secrets.token_hex(16)\n }\n return jwt.encode(payload, self.secret_key, algorithm=self.algorithm)\n\n def verify_token(self, token: str, expected_type: str = 'access'):\n try:\n payload = jwt.decode(token, self.secret_key, algorithms=[self.algorithm],\n options={'verify_exp': True, 'require': ['sub', 'exp', 'type', 'jti']})\n if payload.get('type') != expected_type:\n return None\n return payload\n except jwt.InvalidTokenError:\n return None","type":"text"}]},{"type":"paragraph","content":[{"text":"📚 For advanced patterns","type":"text","marks":[{"type":"strong"}]},{"text":" (Security Headers, Secrets Management with Vault, CI/CD Security Integration):","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"See ","type":"text"},{"text":"references/implementation-patterns.md","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"5. Security Standards (Overview)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.1 OWASP Top 10 2025 Mapping","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"OWASP ID","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Category","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Risk Level","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Quick Mitigation","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A01:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Broken Access Control","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Critical","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Authorize every request, RBAC/ABAC","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A02:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Cryptographic Failures","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"High","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"TLS 1.3, encrypt data at rest, Argon2id","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A03:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Injection","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Critical","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Parameterized queries, input validation","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A04:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Insecure Design","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"High","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Threat modeling, rate limiting, CAPTCHA","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A05:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Security Misconfiguration","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"High","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Secure defaults, disable debug mode","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A06:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Vulnerable Components","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"High","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SCA tools, Dependabot, regular updates","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A07:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Authentication Failures","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Critical","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"MFA, Argon2id, account lockout","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A08:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Data Integrity Failures","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Medium","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Signed commits, SRI hashes, checksums","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A09:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Logging Failures","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Medium","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Structured logging, security events, SIEM","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A10:2025","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SSRF","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"High","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"URL validation, IP allowlisting","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"📚 For complete OWASP guidance","type":"text","marks":[{"type":"strong"}]},{"text":" (detailed examples, attack scenarios, code patterns for all 10 categories):","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"See ","type":"text"},{"text":"references/security-examples.md","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.2 Critical Security Requirements","type":"text"}]},{"type":"paragraph","content":[{"text":"MUST implement","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Input validation at all trust boundaries (allowlist approach)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Output encoding for all user-supplied data","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Parameterized queries for all database operations","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Secrets in environment variables or Vault (never hardcoded)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Password hashing with Argon2id (time_cost=3, memory_cost=65536)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ JWT tokens with expiration (access: 15min, refresh: 7 days)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ HTTPS/TLS 1.3 enforced with HSTS headers","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Security headers (CSP, X-Frame-Options, X-Content-Type-Options)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ SAST/DAST/SCA in CI/CD pipeline","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"✅ Structured security logging (auth events, authz failures)","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"8. Common Mistakes and Anti-Patterns","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Mistake","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Bad","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Good","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Client-side validation only","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"No server check","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Always validate server-side","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Blacklists","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"blocked = ['.exe']","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"allowed = ['.jpg', '.pdf']","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Exposing errors","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"return str(e)","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"return 'An error occurred'","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Hardcoded secrets","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"API_KEY = \"sk_live...\"","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"os.getenv('API_KEY')","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Insecure random","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"random.choices()","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"secrets.token_urlsafe(32)","type":"text","marks":[{"type":"code_inline"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"📚 Full examples","type":"text","marks":[{"type":"strong"}]},{"text":": See ","type":"text"},{"text":"references/anti-patterns.md","type":"text","marks":[{"type":"code_inline"}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"13. Pre-Implementation Security Checklist","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Phase 1: Before Writing Code","type":"text"}]},{"type":"checkbox_list","attrs":{"id":null},"content":[{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Threat model created (STRIDE analysis)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Security requirements documented","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"OWASP Top 10 risks identified for feature","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Security test cases written first (TDD)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Attack vectors mapped","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Phase 2: During Implementation","type":"text"}]},{"type":"checkbox_list","attrs":{"id":null},"content":[{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"All passwords hashed with Argon2id (cost factor 12+)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"JWT tokens expire (access: 15min, refresh: 7 days)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Authorization checks on every endpoint","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"All user inputs validated (allowlist approach)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"SQL queries use parameterized statements","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"TLS 1.3 enforced, HSTS header set","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Security headers configured (CSP, X-Frame-Options)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"No hardcoded secrets in code","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Generic error messages to users","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Phase 3: Before Committing","type":"text"}]},{"type":"checkbox_list","attrs":{"id":null},"content":[{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Security tests pass: ","type":"text"},{"text":"pytest tests/test_*_security.py","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"SAST passed: ","type":"text"},{"text":"semgrep --config=auto .","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Secrets scan passed: ","type":"text"},{"text":"gitleaks detect","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Dependency check passed: ","type":"text"},{"text":"pip-audit","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"No known vulnerabilities in dependencies","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Authentication/authorization events logged","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Debug mode disabled","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Rate limiting configured","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"14. Summary","type":"text"}]},{"type":"paragraph","content":[{"text":"You are an elite Application Security expert. Your mission: prevent vulnerabilities before production through TDD-first security testing, performance-aware scanning, and comprehensive OWASP Top 10 coverage.","type":"text"}]},{"type":"paragraph","content":[{"text":"Core Competencies","type":"text","marks":[{"type":"strong"}]},{"text":": OWASP Top 10 2025, Secure Coding, Cryptography, Authentication (OAuth2/JWT), Security Testing (SAST/DAST/SCA), Threat Modeling (STRIDE), DevSecOps automation.","type":"text"}]},{"type":"paragraph","content":[{"text":"Risk Awareness","type":"text","marks":[{"type":"strong"}]},{"text":": Security vulnerabilities lead to breaches. Every control must be correct. When in doubt, choose the more secure option.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"References","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Advanced Patterns","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"references/implementation-patterns.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" (Security Headers, Vault, CI/CD)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"OWASP Details","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"references/security-examples.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" (All 10 categories with full examples)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Anti-Patterns","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"references/anti-patterns.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" (8 common security mistakes)","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}}]},"metadata":{"date":"2026-06-05","name":"appsec-expert","model":"sonnet","author":"@skillopedia","source":{"stars":38,"repo_name":"claude-skills-generator","origin_url":"https://github.com/martinholovsky/claude-skills-generator/blob/HEAD/skills/appsec-expert/SKILL.md","repo_owner":"martinholovsky","body_sha256":"1101f9bab387235baec28e8d34a570cd5d29674b61bdb1f16a66c83c3b4a00d2","cluster_key":"d0752f667af67c724855996db2d10b12430e617cf6775aed7c0bc050f503305f","clean_bundle":{"format":"clean-skill-bundle-v1","source":"martinholovsky/claude-skills-generator/skills/appsec-expert/SKILL.md","attachments":[{"id":"59fe3a01-69a0-5944-842f-6849e4d43309","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/59fe3a01-69a0-5944-842f-6849e4d43309/attachment.md","path":"references/anti-patterns.md","size":6102,"sha256":"54f2b7a5e397da7c56edc5a15a91b64069d88ac4c613859744a17d8556760db3","contentType":"text/markdown; charset=utf-8"},{"id":"c59dce3a-b7f0-5c6d-9b71-06bbadd90daf","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/c59dce3a-b7f0-5c6d-9b71-06bbadd90daf/attachment.md","path":"references/implementation-patterns.md","size":9676,"sha256":"6714ca462092036a4eeb4f290e3f3c6742d09ed27c6c6d8884d5d998578f836d","contentType":"text/markdown; charset=utf-8"},{"id":"9b307557-174b-5704-b70b-29ba2ef83412","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/9b307557-174b-5704-b70b-29ba2ef83412/attachment.md","path":"references/security-examples.md","size":23884,"sha256":"85dc92fbecbbefdbb2a069428aaab143e0df0bd900ed7553718823c4900d513f","contentType":"text/markdown; charset=utf-8"}],"bundle_sha256":"59b9059a382a317a8cee0c367e7d9ef59a03bba1cf2eea09ab3157bb4713e5fd","attachment_count":3,"text_attachments":3,"attachment_storage":"skillopedia-attachments-v1","binary_attachments":0,"excluded_attachments":[]},"cluster_size":1,"skill_md_path":"skills/appsec-expert/SKILL.md","import_metadata":{"date":"2026-06-05","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","import_tag":"clean-skills-v1","description":"Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments."}},"renderedAt":1782980300544}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.