Security

Security Rules

1. Input Validation Principles

2. Authentication and Authorization Principles

• Apply least privilege — grant minimum permissions needed
• Use role-based access control (RBAC) at endpoint level
• Apply defense in depth — check authorization in service layer, not just URL
• Use method-level security for fine-grained control
• Log all authentication failures and authorization denials
• Never rely on URL-based security alone

3. CORS Principles

• Never use wildcard (*) origins in production
• Explicitly list allowed origins, methods, and headers
• Set maxAge to reduce preflight requests
• Separate CORS config per environment (dev may be more permissive)

4. API Security Headers

5. Rate Limiting Guidelines

Recommended Limits

Response Headers

• X-RateLimit-Limit: Maximum requests allowed in window
• X-RateLimit-Remaining: Requests remaining in current window
• X-RateLimit-Reset: Timestamp when the window resets

6. Sensitive Data in Responses

Never Expose

• Password hashes
• Internal IDs when external IDs exist
• Stack traces or internal error details
• Database column names in error messages
• Server version or framework information

Response Filtering

• Use dedicated response DTOs — never return entities directly
• Exclude internal fields (password, internal flags, audit metadata)
• Map entities to response objects at the API boundary

7. Secret Management Principles

• Store secrets in environment variables or secret manager (Vault, AWS SSM, etc.)
• Never commit secrets to version control
• Rotate secrets periodically (at least every 90 days)
• Use different secrets per environment
• Revoke and rotate immediately if any secret is exposed
• Never provide default values for secrets in configuration files

8. Anti-Patterns

• Hardcoding secrets in source code or config files
• Returning entities directly from API endpoints
• Using wildcard CORS in production
• Missing rate limiting on authentication endpoints
• Logging sensitive data (passwords, tokens, PII)
• Trusting client-side validation without server-side checks
• Exposing detailed error internals in API responses
• Security by Obscurity: Relying solely on hiding for security. Design systems to be secure even when exposed
• Rolling Your Own Crypto: Using unverified custom encryption algorithms. Use standard libraries (AES, RSA, bcrypt)
• Excessive Permissions: Violating the principle of least privilege. Grant only the minimum required permissions
• Delayed Security Updates: Postponing known CVE patches increases attack exposure. Apply patches immediately

9. OWASP Top 10 Awareness

OWASP (Open Worldwide Application Security Project) publishes the industry-standard list of the most critical web application security risks. The OWASP Top 10 is updated every 3-4 years (latest: 2021) and serves as the de facto security baseline for code reviews, audits, and compliance.

When writing code, be vigilant against all 10 categories:

10. Container and Supply Chain Security

Securing containers and the software supply chain is essential for modern cloud-native deployments. For detailed patterns, see references/container-supply-chain.md.

Key Rules

• Use minimal base images (distroless, Alpine) — reduce attack surface
• Run containers as non-root user — set USER directive in Dockerfile
• Generate and attest SBOMs (Software Bill of Materials) with Syft or Trivy
• Sign container images with Cosign (Sigstore keyless signing)
• Enforce admission policies (OPA/Gatekeeper, Kyverno) in Kubernetes clusters
• Target SLSA Build Level 2+ for production workloads — provenance attestation required

Supply Chain Controls

Related Skills

• For secret lifecycle management (rotation, storage, detection), see secrets-management skill
• For Kubernetes security (RBAC, NetworkPolicy, Pod Security), see k8s-workflow skill

Additional References

• For authentication and authorization implementation patterns, see references/authentication.md
• For web protection (CSRF, XSS, injection defense, TLS), see references/web-protection.md
• For container and supply chain security (SBOM, Cosign, SLSA, Kyverno, image hardening), see references/container-supply-chain.md
• For Spring Boot implementation patterns (SecurityFilterChain, Bean Validation), see spring-framework skill — references/security.md