Python Web App Security Audit
Run a configurable pytest suite against a local Python web application before release. It uses ASGI, the interface between a Python web app and its server, so the checks can exercise FastAPI, Django, Flask through an adapter, and comparable services without opening a public server.
Scope
The bundled checks cover authentication, authorization, input validation, response headers, CORS, cookies, rate limits, error handling, HTTP method handling, and unsafe configuration. Read setup and boundaries, framework adapters, route configuration, fixture safety, and assertion catalog before adapting the suite to an application.
Do not represent a passing run as a penetration test or proof of production security. The suite does not verify deployment TLS, a WAF, dependency vulnerabilities, external infrastructure, or controls it cannot reach through the configured test application.
Prepare the suite
Install the dependencies in the target project's isolated environment.
pip install "pytest>=8" "pytest-asyncio>=0.24" "httpx>=0.27" python-dotenv
Copy the bundled suite into the target project without overwriting an existing security directory.
python scripts/prepare_security_suite.py C:\path\to\your-project
The helper copies security/, pytest.ini when absent, and the .env.test.template file. It never creates a credentials file.
In the copied security/ directory, copy .env.test.template to .env.test. Supply an app import path, routes, rate limit, permitted origin, and dedicated test credentials. Keep .env.test out of version control.
From the target project root, run the suite.
pytest security/ -v
Operating rules
- Test actual application behavior, not framework defaults.
- Use dedicated test accounts and non-production data.
- Configure route variables before treating a failing default route as a defect.
- Inspect every failure before assigning a release gate.
- Keep application-layer findings separate from infrastructure findings.
- Report both verified results and test boundaries.
- Do not add checks that create accounts, alter records, or issue destructive database commands. This bundled suite is non-destructive.
Report the result
Use the report template, release decision guide, and continuous integration guide. For every finding, state the affected route or control, evidence, severity, recommended fix, and what was not tested. End with one of these release decisions:
- BLOCKED: A confirmed issue must be fixed before release.
- REVIEW REQUIRED: A material risk remains and needs an owner decision.
- PASS: The configured checks found no blocking or review-level issue. This does not prove complete security.
Suite contents
| File |
Purpose |
security/conftest.py |
Application import, test client, authentication fixtures, and route helpers |
security/test_headers.py |
Header presence and directive quality |
security/test_validation.py |
Hostile input, malformed payloads, and type coercion |
security/test_auth.py |
Authentication enforcement and enumeration resistance |
security/test_authorization.py |
Object ownership, role boundaries, and mass assignment |
security/test_rate_limit.py |
Threshold and 429 response checks |
security/test_errors.py |
Error sanitization and internal detail leakage |
security/test_cors.py |
Origin restrictions and preflight handling |
security/test_cookies.py |
Cookie flag enforcement |
security/test_config.py |
Debug exposure, method handling, and configuration checks |
Boundaries
This skill does not replace manual security assessment, dependency scanning, production HTTPS verification, WAF validation, or dynamic scanning. Add an application-specific CSRF test when state-changing requests use cookie authentication.
The bundled suite does not create accounts, delete records, or execute schema-changing database commands. Assess any registration or other write flow only in an application-owned test suite with a disposable database and explicit cleanup.
1---2name: python-web-app-security-audit3description: Run defensive pre-release security tests for Python web applications. Use for FastAPI, Django, Flask, and ASGI services: the common interface between Python web apps and servers. Tests authentication, authorization, hostile input, headers, CORS, cookies, rate limits, errors, and configuration to return evidence-backed findings and clear test boundaries.4license: MIT5---6
7# Python Web App Security Audit
8
9Run a configurable pytest suite against a local Python web application before release. It uses ASGI, the interface between a Python web app and its server, so the checks can exercise FastAPI, Django, Flask through an adapter, and comparable services without opening a public server.
10
11## Scope
12
13The bundled checks cover authentication, authorization, input validation, response headers, CORS, cookies, rate limits, error handling, HTTP method handling, and unsafe configuration. Read [setup and boundaries](references/setup-and-boundaries.md), [framework adapters](references/framework-adapters.md), [route configuration](references/route-configuration.md), [fixture safety](references/fixture-safety.md), and [assertion catalog](references/assertion-catalog.md) before adapting the suite to an application.
14
15Do not represent a passing run as a penetration test or proof of production security. The suite does not verify deployment TLS, a WAF, dependency vulnerabilities, external infrastructure, or controls it cannot reach through the configured test application.
16
17## Prepare the suite
18
191. Install the dependencies in the target project's isolated environment.
20
21 ```bash
22 pip install "pytest>=8" "pytest-asyncio>=0.24" "httpx>=0.27" python-dotenv
23 ```
24
252. Copy the bundled suite into the target project without overwriting an existing security directory.
26
27 ```bash
28 python scripts/prepare_security_suite.py C:\path\to\your-project
29 ```
30
31 The helper copies `security/`, `pytest.ini` when absent, and the `.env.test.template` file. It never creates a credentials file.
32
333. In the copied `security/` directory, copy `.env.test.template` to `.env.test`. Supply an app import path, routes, rate limit, permitted origin, and dedicated test credentials. Keep `.env.test` out of version control.
34
354. From the target project root, run the suite.
36
37 ```bash
38 pytest security/ -v
39 ```
40
41## Operating rules
42
431. Test actual application behavior, not framework defaults.
442. Use dedicated test accounts and non-production data.
453. Configure route variables before treating a failing default route as a defect.
464. Inspect every failure before assigning a release gate.
475. Keep application-layer findings separate from infrastructure findings.
486. Report both verified results and test boundaries.
497. Do not add checks that create accounts, alter records, or issue destructive database commands. This bundled suite is non-destructive.
50
51## Report the result
52
53Use [the report template](assets/security-audit-report-template.md), [release decision guide](docs/release-decision-guide.md), and [continuous integration guide](docs/continuous-integration-guide.md). For every finding, state the affected route or control, evidence, severity, recommended fix, and what was not tested. End with one of these release decisions:
54
55- **BLOCKED:** A confirmed issue must be fixed before release.
56- **REVIEW REQUIRED:** A material risk remains and needs an owner decision.
57- **PASS:** The configured checks found no blocking or review-level issue. This does not prove complete security.
58
59## Suite contents
60
61| File | Purpose |
62|---|---|
63| `security/conftest.py` | Application import, test client, authentication fixtures, and route helpers |
64| `security/test_headers.py` | Header presence and directive quality |
65| `security/test_validation.py` | Hostile input, malformed payloads, and type coercion |
66| `security/test_auth.py` | Authentication enforcement and enumeration resistance |
67| `security/test_authorization.py` | Object ownership, role boundaries, and mass assignment |
68| `security/test_rate_limit.py` | Threshold and 429 response checks |
69| `security/test_errors.py` | Error sanitization and internal detail leakage |
70| `security/test_cors.py` | Origin restrictions and preflight handling |
71| `security/test_cookies.py` | Cookie flag enforcement |
72| `security/test_config.py` | Debug exposure, method handling, and configuration checks |
73
74## Boundaries
75
76This skill does not replace manual security assessment, dependency scanning, production HTTPS verification, WAF validation, or dynamic scanning. Add an application-specific CSRF test when state-changing requests use cookie authentication.
77
78The bundled suite does not create accounts, delete records, or execute schema-changing database commands. Assess any registration or other write flow only in an application-owned test suite with a disposable database and explicit cleanup.
aiskillstore