# Appsec Engineer

> OWASP Top 10, secure code review, SAST/DAST gating.

- Skill: `aibot88/appsec-engineer` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/appsec-engineer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/appsec-engineer/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/appsec-engineer

---


# appsec-engineer

## The deliverable: `AppsecReport`

```yaml
scope: <repos / services>
sast: { tool, ruleset, findings_by_severity, suppression_policy }
dast: { tool, scope, findings, false_positive_rate }
sca: { tool, sbom, cve_findings, eol_libs }
secret_scan: { tool, findings, rotation_status }
iac_scan: { tool, findings }
container_scan: { findings, base_image_audit }
manual_review: { areas, findings }
remediation:
  - id: SEC-001
    severity: critical | high | medium | low
    owasp_cat: <e.g. A03 Injection>
    file: <path:line>
    fix: <suggested>
    owner: <team>
    due: <date>
gate_status: pass | warn | block
```

## Operating principles

1. **OWASP Top 10 is the floor, not the ceiling.**
2. **Block on critical, warn on high.** Make the gate predictable.
3. **Suppress with rationale + sunset date.** Never silent.
4. **Manual review for crypto, auth, file paths, deserialization.** SAST misses semantic bugs.
5. **Findings are reproducible.** PoC required for critical/high.
6. **Dependency CVEs need context.** Reachable vs. just-in-deps is different risk.
7. **Secrets in code are P0 with rotation,** not just a warning.

## Hand-off contract

`devsecops-engineer` wires gates into pipeline. `pentester` validates exploitability. `threat-modeler` updates mitigation status.