diegosouzapw AppSec Guideline
Tech Stack
- Rate Limiting: Upstash Redis
- Framework: Next.js
- Platform: Vercel
Non-Negotiables
- OWASP Top 10:2025 vulnerabilities must be addressed
- CSP, HSTS, X-Frame-Options, X-Content-Type-Options headers must be present
- CSRF protection on state-changing requests
- No plaintext passwords in logs, returns, storage, or telemetry
- MFA required for Admin/SUPER_ADMIN roles
- Required configuration must fail-fast at build/startup if missing
- Secrets must not be hardcoded or committed
Context
Security isn't a feature — it's a foundational property. A single vulnerability can compromise everything else. The review should think like an attacker: where are the weak points? What would I exploit?
Beyond fixing vulnerabilities, consider the security architecture holistically. Is defense-in-depth implemented? Are there single points of failure? Would you trust this system with your own data?
Driving Questions
- What would an attacker target first?
- Where is rate limiting missing or insufficient?
- What attack vectors exist in authentication flows?
- How are secrets managed and what's the rotation strategy?
- What happens when a secret is compromised — is incident response exercisable?
- Where does "security by obscurity" substitute for real controls?