# Application Security

> Secure software development practices

- Skill: `ffsshhttiikk/application-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ffsshhttiikk/application-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ffsshhttiikk/application-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: ffsshhttiikk (https://skillmd.com/u/ffsshhttiikk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ffsshhttiikk/application-security

---


## What I do
- Implement secure software development lifecycle (SDLC)
- Identify and mitigate application vulnerabilities
- Design and implement authentication/authorization systems
- Conduct security code reviews
- Implement input validation and output encoding
- Configure web application firewalls
- Handle sensitive data securely
- Implement secure session management

## When to use me
When building, reviewing, or securing web applications, APIs, or any software that processes user data or requires protection against attacks.

## Secure Development Lifecycle

### Threat Modeling
```python
class ThreatModel:
    """Identify threats during design phase"""
    
    def __init__(self, application: str):
        self.application = application
        self.threats = []
    
    def add_data_flow(self, source: str, dest: str, data_type: str):
        """Model data flows to identify trust boundaries"""
        self.threats.append({
            'source': source,
            'destination': dest,
            'data_type': data_type,
            'trust_boundary': self._is_trust_boundary(source, dest)
        })
    
    def _is_trust_boundary(self, source: str, dest: str) -> bool = ['app_server', 'database']
:
        trusted        untrusted = ['user_browser', 'external_api']
        return (source in untrusted and dest in trusted) or \
               (source in trusted and dest in untrusted)
```

### Input Validation
```python
from pydantic import BaseModel, validator
import re

class UserRegistration(BaseModel):
    username: str
    email: str
    password: str
    
    @validator('email')
    def validate_email(cls, v):
        pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
        if not re.match(pattern, v):
            raise ValueError('Invalid email format')
        return v.lower()
    
    @validator('password')
    def validate_password(cls, v):
        if len(v) < 12:
            raise ValueError('Password must be at least 12 characters')
        if not re.search(r'[A-Z]', v):
            raise ValueError('Password must contain uppercase')
        if not re.search(r'[0-9]', v):
            raise ValueError('Password must contain numbers')
        return v
```

### Output Encoding
```python
import html

def safe_render(user_input: str) -> str:
    return html.escape(user_input)
```

## Authentication Patterns

### MFA Implementation
```python
import pyotp

class MFAProvider:
    def __init__(self, secret: str = None):
        self.secret = secret or pyotp.random_base32()
    
    def get_qr_uri(self, account_name: str) -> str:
        return pyotp.totp(self.secret).provisioning_uri(
            account_name, issuer_name="MyApp"
        )
    
    def verify(self, token: str) -> bool:
        totp = pyotp.TOTP(self.secret)
        return totp.verify(token, valid_window=1)
```

### Session Management
```python
import secrets
from datetime import datetime, timedelta

class SecureSessionManager:
    def __init__(self):
        self.sessions = {}
        self.session_timeout = timedelta(hours=1)
    
    def create_session(self, user_id: str) -> str:
        session_id = secrets.token_hex(32)
        self.sessions[session_id] = {
            'user_id': user_id,
            'created_at': datetime.now(),
            'last_activity': datetime.now()
        }
        return session_id
```

## Authorization Models

### RBAC Implementation
```python
from enum import Enum
from functools import wraps

class Role(Enum):
    ADMIN = "admin"
    USER = "user"
    GUEST = "guest"

class Permission(Enum):
    READ = "read"
    WRITE = "write"
    DELETE = "delete"

ROLE_PERMISSIONS = {
    Role.ADMIN: {Permission.READ, Permission.WRITE, Permission.DELETE},
    Role.USER: {Permission.READ, Permission.WRITE},
    Role.GUEST: {Permission.READ}
}

def require_permission(permission: Permission):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            if not current_user.has_permission(permission):
                abort(403)
            return f(*args, **kwargs)
        return decorated_function
    return decorator
```