Security Testing
Application-layer security testing for web services, APIs, and codebases.
When to use
- Validating OWASP Top 10 vulnerabilities in a web application
- Testing authentication and authorisation flows for bypass vulnerabilities
- API security testing (endpoint exposure, rate limiting, input validation)
- Scanning dependencies for known CVEs
- Detecting secrets and credentials accidentally committed to code
- SAST (static analysis) or DAST (dynamic analysis) workflows
When NOT to use
- Linux system hardening, firewall rules, CIS compliance → use
defense-security
- Code quality gates and TDD → use
build-with-quality
- Infrastructure security scanning → use
defense-security
Core Capabilities
OWASP Top 10 Coverage
| Category |
Tests |
| A01 Broken Access Control |
Path traversal, IDOR, privilege escalation |
| A02 Cryptographic Failures |
Weak ciphers, exposed secrets, insecure transport |
| A03 Injection |
SQL, XSS, command injection, SSTI |
| A04 Insecure Design |
Business logic flaws, missing rate limits |
| A05 Security Misconfiguration |
Default credentials, exposed debug, CORS |
| A06 Vulnerable Components |
Dependency CVE scanning |
| A07 Auth Failures |
Session fixation, weak tokens, brute force |
| A08 Software Integrity |
Supply chain checks, SBOM |
| A09 Logging Failures |
Missing audit trails, sensitive data in logs |
| A10 SSRF |
Server-side request forgery testing |
Tools Used
- Static analysis: semgrep, bandit (Python), gosec (Go), eslint-plugin-security
- Dependency scanning: npm audit, pip-audit, cargo audit, trivy
- Secrets detection: gitleaks, trufflehog
- Dynamic testing: OWASP ZAP (via Docker), custom request sequences
- Browser-based:
qe-browser for injection scanner (install with aqe init)
Quick Start
Dependency vulnerability scan
# Node.js
npm audit --audit-level=moderate
# Python
pip-audit
# Rust
cargo audit
# Container image
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
aquasec/trivy image <your-image>
Secrets scan
# Install gitleaks if not present
which gitleaks || brew install gitleaks
# Scan current repo
gitleaks detect --source . --verbose
SAST with semgrep
# Install semgrep
pip install semgrep
# Run OWASP ruleset
semgrep --config p/owasp-top-ten .
Integration with build-with-quality
Security testing integrates with build-with-quality as a quality gate:
- Run security tests in Phase 3 (QE Verification) of the EDD pipeline
- Failed security gates block the truth-score from reaching 0.95
- Use
verification-quality to track security gate pass/fail history
See also
defense-security — Linux system hardening, CIS/HIPAA/SOC2 compliancebuild-with-quality — Full development pipeline with integrated security agentsqe-browser — Browser-based injection and XSS scanning (after aqe init)
1---2name: security-testing3description: Application security testing: OWASP Top 10 validation, authentication/authorisation testing, API security, dependency vulnerability scanning, secrets detection, injection testing, SAST/DAST workflows. Use for web application and API security validation — not for Linux system hardening (use defense-security for that).4---56# Security Testing78Application-layer security testing for web services, APIs, and codebases.910## When to use1112- Validating OWASP Top 10 vulnerabilities in a web application13- Testing authentication and authorisation flows for bypass vulnerabilities14- API security testing (endpoint exposure, rate limiting, input validation)15- Scanning dependencies for known CVEs16- Detecting secrets and credentials accidentally committed to code17- SAST (static analysis) or DAST (dynamic analysis) workflows1819## When NOT to use2021- Linux system hardening, firewall rules, CIS compliance → use `defense-security`22- Code quality gates and TDD → use `build-with-quality`23- Infrastructure security scanning → use `defense-security`2425## Core Capabilities2627### OWASP Top 10 Coverage2829| Category | Tests |30|----------|-------|31| A01 Broken Access Control | Path traversal, IDOR, privilege escalation |32| A02 Cryptographic Failures | Weak ciphers, exposed secrets, insecure transport |33| A03 Injection | SQL, XSS, command injection, SSTI |34| A04 Insecure Design | Business logic flaws, missing rate limits |35| A05 Security Misconfiguration | Default credentials, exposed debug, CORS |36| A06 Vulnerable Components | Dependency CVE scanning |37| A07 Auth Failures | Session fixation, weak tokens, brute force |38| A08 Software Integrity | Supply chain checks, SBOM |39| A09 Logging Failures | Missing audit trails, sensitive data in logs |40| A10 SSRF | Server-side request forgery testing |4142### Tools Used4344- **Static analysis**: semgrep, bandit (Python), gosec (Go), eslint-plugin-security45- **Dependency scanning**: npm audit, pip-audit, cargo audit, trivy46- **Secrets detection**: gitleaks, trufflehog47- **Dynamic testing**: OWASP ZAP (via Docker), custom request sequences48- **Browser-based**: `qe-browser` for injection scanner (install with `aqe init`)4950## Quick Start5152### Dependency vulnerability scan53```bash54# Node.js55npm audit --audit-level=moderate5657# Python58pip-audit5960# Rust61cargo audit6263# Container image64docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \65 aquasec/trivy image <your-image>66```6768### Secrets scan69```bash70# Install gitleaks if not present71which gitleaks || brew install gitleaks7273# Scan current repo74gitleaks detect --source . --verbose75```7677### SAST with semgrep78```bash79# Install semgrep80pip install semgrep8182# Run OWASP ruleset83semgrep --config p/owasp-top-ten .84```8586## Integration with build-with-quality8788Security testing integrates with `build-with-quality` as a quality gate:89- Run security tests in Phase 3 (QE Verification) of the EDD pipeline90- Failed security gates block the truth-score from reaching 0.9591- Use `verification-quality` to track security gate pass/fail history9293## See also9495- `defense-security` — Linux system hardening, CIS/HIPAA/SOC2 compliance96- `build-with-quality` — Full development pipeline with integrated security agents97- `qe-browser` — Browser-based injection and XSS scanning (after `aqe init`)
dreamlab-ai