// ✅ Good: React automatically escapes

{userContent}

// ✅ Good: Sanitize HTML if needed import DOMPurify from 'dompurify';

``` ### 4. Insecure Design **Checklist:** - [ ] Implement threat modeling during design phase - [ ] Use secure design patterns and reference architectures - [ ] Implement defense in depth (multiple security layers) - [ ] Separate tenants/users robustly - [ ] Limit resource consumption per user/transaction - [ ] Use secure libraries and frameworks - [ ] Document security requirements and assumptions **Example - Rate Limiting:** ```python from flask_limiter import Limiter from flask_limiter.util import get_remote_address limiter = Limiter( app, key_func=get_remote_address, default_limits=["200 per day", "50 per hour"] ) @app.route("/api/login", methods=["POST"]) @limiter.limit("5 per minute") def login(): # Login logic pass ``` ### 5. Security Misconfiguration **Checklist:** - [ ] Remove default accounts and passwords - [ ] Disable unnecessary features, ports, and services - [ ] Keep all software up to date (dependencies, OS, frameworks) - [ ] Implement proper error handling (don't expose stack traces) - [ ] Configure security headers properly - [ ] Use environment-specific configurations - [ ] Regular security scanning and patching **Example - Security Headers:** ```python # Flask security headers from flask_talisman import Talisman talisman = Talisman( app, force_https=True, strict_transport_security=True, strict_transport_security_max_age=31536000, content_security_policy={ 'default-src': "'self'", 'img-src': '*', 'script-src': "'self' 'unsafe-inline'", 'style-src': "'self' 'unsafe-inline'" }, content_security_policy_nonce_in=['script-src'] ) ``` ### 6. Vulnerable and Outdated Components **Checklist:** - [ ] Maintain inventory of all components and versions - [ ] Monitor for security advisories (CVE databases) - [ ] Remove unused dependencies - [ ] Only use official sources for components - [ ] Prefer signed packages when available - [ ] Automate dependency scanning (Snyk, Dependabot) - [ ] Regularly update dependencies **Example - Dependency Scanning:** ```bash # Python - Check for vulnerabilities pip install safety safety check # Node.js - Check for vulnerabilities npm audit npm audit fix # Automated scanning in CI/CD - name: Run Snyk security scan uses: snyk/actions/node@master env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} ``` ### 7. Identification and Authentication Failures **Checklist:** - [ ] Implement multi-factor authentication (MFA) - [ ] Don't ship with default credentials - [ ] Enforce strong password policies - [ ] Implement account lockout after failed attempts - [ ] Use secure session management - [ ] Regenerate session IDs after authentication - [ ] Implement proper logout functionality - [ ] Use HTTP-only and Secure flags on cookies **Example - Secure Session Management:** ```python from flask import session import secrets app.config['SECRET_KEY'] = secrets.token_hex(32) app.config['SESSION_COOKIE_SECURE'] = True # HTTPS only app.config['SESSION_COOKIE_HTTPONLY'] = True # No JavaScript access app.config['SESSION_COOKIE_SAMESITE'] = 'Lax' # CSRF protection app.config['PERMANENT_SESSION_LIFETIME'] = 3600 # 1 hour @app.route('/login', methods=['POST']) def login(): if verify_credentials(request.form): session.clear() # Clear old session session['user_id'] = user.id session.permanent = True return redirect('/dashboard') ``` ### 8. Software and Data Integrity Failures **Checklist:** - [ ] Use digital signatures to verify software integrity - [ ] Verify dependencies from trusted repositories - [ ] Use CI/CD pipeline security best practices - [ ] Implement code review process - [ ] Separate development, staging, and production - [ ] Implement proper backup and recovery procedures - [ ] Monitor for unauthorized changes **Example - Content Integrity:** ```html ``` ### 9. Security Logging and Monitoring Failures **Checklist:** - [ ] Log all authentication events (success and failure) - [ ] Log access control failures - [ ] Log input validation failures - [ ] Ensure logs are tamper-proof - [ ] Implement log monitoring and alerting - [ ] Don't log sensitive data (passwords, tokens, PII) - [ ] Use centralized logging solution **Example - Security Logging:** ```python import logging from logging.handlers import RotatingFileHandler # Configure security logger security_logger = logging.getLogger('security') handler = RotatingFileHandler('security.log', maxBytes=10000000, backupCount=5) formatter = logging.Formatter( '%(asctime)s - %(name)s - %(levelname)s - %(message)s' ) handler.setFormatter(formatter) security_logger.addHandler(handler) security_logger.setLevel(logging.INFO) # Log security events @app.route('/login', methods=['POST']) def login(): email = request.form.get('email') if verify_credentials(request.form): security_logger.info(f"Login successful: {email}") return redirect('/dashboard') else: security_logger.warning(f"Login failed: {email} from {request.remote_addr}") return render_template('login.html', error="Invalid credentials") ``` ### 10. Server-Side Request Forgery (SSRF) **Checklist:** - [ ] Validate and sanitize all user-supplied URLs - [ ] Use allowlist for allowed domains/IPs - [ ] Disable HTTP redirections - [ ] Don't send raw responses to clients - [ ] Implement network segmentation - [ ] Block access to internal services - [ ] Use DNS resolution validation **Example - SSRF Prevention:** ```python from urllib.parse import urlparse import requests ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com'] def fetch_url(user_url): # Parse and validate URL parsed = urlparse(user_url) # Check protocol if parsed.scheme not in ['http', 'https']: raise ValueError("Invalid protocol") # Check domain against allowlist if parsed.netloc not in ALLOWED_DOMAINS: raise ValueError("Domain not allowed") # Block private IP ranges if is_private_ip(parsed.hostname): raise ValueError("Private IPs not allowed") # Make request with timeout response = requests.get( user_url, timeout=5, allow_redirects=False # Prevent redirect attacks ) return response.content ``` ## Additional Security Measures ### API Security - [ ] Implement API authentication (OAuth 2.0, JWT) - [ ] Use API keys for service-to-service communication - [ ] Implement request signing for sensitive operations - [ ] Rate limit API endpoints - [ ] Validate content type headers - [ ] Implement API versioning ### Frontend Security - [ ] Implement Content Security Policy - [ ] Use HTTPS for all resources - [ ] Sanitize user input before display - [ ] Don't store sensitive data in localStorage - [ ] Implement proper CORS configuration - [ ] Use Subresource Integrity for CDN resources ### Infrastructure Security - [ ] Use firewalls and security groups - [ ] Implement network segmentation - [ ] Regular security patching - [ ] Encrypt databases and backups - [ ] Use secrets management (HashiCorp Vault, AWS Secrets Manager) - [ ] Regular penetration testing ## Security Tools **Static Analysis (SAST):** - Semgrep (multi-language) — see [semgrep-sast](../semgrep-sast/SKILL.md) skill for detailed usage - Bandit (Python) - ESLint security plugin (JavaScript) - SonarQube **Dependency Scanning:** - Snyk - OWASP Dependency-Check - GitHub Dependabot **Dynamic Testing:** - OWASP ZAP - Burp Suite - Nikto **Secrets Scanning:** - TruffleHog - GitGuardian - git-secrets ## Additional Resources - `/semgrep-sast` — automated SAST scanning via the Semgrep MCP plugin - `/silent-failure-audit` — swallowed errors, hardcoded status, no-op handlers - `/pipeline-quality` step 4 — the three-part security gate this skill feeds