Security Best Practices

Security Best Practices

Review and harden application code against the vulnerabilities that actually get exploited: injection, broken authentication, IDOR, XSS, insecure secrets, weak dependencies. This skill is actionable engineering guidance, not a compliance checklist — each vulnerability class maps to a concrete code-level fix, with cheat-sheets for Python, JavaScript/TypeScript, and Go plus a worked secure-login example.

Quick Reference

Core Workflow

1. Scope the review. List entry points (HTTP routes, message consumers, CLIs, file processors), sensitive data (PII, credentials, payment data), and trust boundaries. Note the languages/frameworks so the right cheat-sheet applies.
2. Threat-model in 5 minutes. Run the STRIDE table below per entry point; mark high-risk flows (auth, uploads, deserialization, outbound HTTP). Full worksheet: threat-modeling.md.
3. Walk the OWASP map. Check every applicable row in the table below. Most findings come from three rows: access control (IDOR), injection, and security misconfiguration.
4. Verify secure defaults and apply the cheat-sheet. TLS, headers, CORS, cookies, non-leaky errors (Secure Defaults), then grep for your language's dangerous patterns (SQL f-strings, pickle, innerHTML, eval) and fix confirmed hits.
5. Report findings. Prioritize by severity × likelihood; give file:line, the vulnerability class, why it matters, and the fix. Offer to implement the fixes.

Threat Modeling in 5 Minutes

Trust boundaries sit wherever untrusted input crosses into trusted code (HTTP body → DB query, user input → shell, upload → storage, deserialized data → app, browser → API, app → internal services); every crossing is an attack surface. Least privilege: DB app-user gets SELECT/INSERT on its schema, never DROP/admin; run the OS process unprivileged; scoped IAM roles with short-lived credentials; no "admin mode" that bypasses checks.

OWASP Top 10 → Code-Level Fixes

Authentication

Password storage

Never store plaintext, reversible encryption, or fast hashes (MD5/SHA-1/SHA-256 — trivially brute-forced). Use a dedicated password-hashing KDF:

# Python (argon2id — preferred)
from argon2 import PasswordHasher
ph = PasswordHasher()                # defaults: m=65536, t=3, p=4
stored = ph.hash(password)           # store this string
ph.verify(stored, password)          # raises on mismatch

import { hash, verify } from "@node-rs/argon2";   // or bcrypt with cost >= 12
const stored = await hash(password, { memoryCost: 65536, timeCost: 3, parallelism: 4 });
await verify(stored, password);

Salt is automatic with these libraries; bcrypt cost ≥ 12; rehash on upgrade from legacy MD5/SHA1 stores.

Sessions, MFA, and rate limiting

• Session ID: 256-bit random (secrets.token_urlsafe(32) / crypto.randomBytes(32)), never derived from input.
• Cookie: HttpOnly, Secure, SameSite=Lax (or Strict), __Host- prefix where supported.
• Rotate the session ID on login/privilege change; invalidate server-side on logout; idle timeout (30 min) + absolute timeout (24 h).
• TOTP via pyotp (Python) / otplib (Node), mandatory for admin accounts; rate limit login per IP and per account with backoff.
• Identical error messages and comparable work whether the user exists or not (no user enumeration, no timing side-channel).

Authorization

IDOR prevention: never trust a client-supplied ID to imply access. Scope every query to the authenticated user and return 404 (not 403) when the record isn't theirs, so you don't create an ID-existence oracle:

def get_invoice(invoice_id: int, user=Depends(get_current_user)):
    invoice = db.scalar(select(Invoice).where(Invoice.id == invoice_id,
                                              Invoice.owner_id == user.id))
    if invoice is None:
        raise HTTPException(404)      # same as "not found"
    return invoice

Enforce authorization at the service layer, not just the router, on every endpoint — including hidden admin routes, which must still be verified server-side.

JWT, OAuth2, and OIDC

JWT verification — non-negotiables (full checklist + alg-confusion attack: jwt-oauth.md):

import jwt
payload = jwt.decode(
    token,
    key=public_key,                    # from the issuer's JWKS — never hardcoded or ignored
    algorithms=["RS256"],              # allowlist — never "none" or HS256 with an RSA key
    audience="https://api.example.com",
    issuer="https://auth.example.com",
    options={"require": ["exp", "iat", "nbf"]},
)

• Verify signature, exp, nbf, iss, aud — always. Reject alg: none. JWTs are signed, not encrypted — never put secrets or PII in the payload.
• Access tokens short-lived (minutes); refresh tokens rotated and revocable server-side. Never store tokens in localStorage (any XSS reads them); first-party apps use httpOnly cookies; never log tokens or pass them in URLs.

Input Validation & Injection

SQL injection

Never build SQL with concatenation, f-strings, %, or .format — parameterize or use ORM bindings:

# Bad — injectable via `name`
cursor.execute(f"SELECT * FROM users WHERE name = '{name}'")
# Good
cursor.execute("SELECT * FROM users WHERE name = %s", (name,))

With ORMs (SQLAlchemy, Prisma, Django) prefer the query-builder; raw SQL only with bound parameters. Beware string-concat into ORM "extra" clauses.

XSS, CSRF, and SSRF

• Encode for the correct context (HTML, attribute, JS, URL). React/Vue auto-escape text; danger is in sinks: innerHTML, document.write, dangerouslySetInnerHTML, v-html. Add a restrictive CSP (default-src 'self'); sanitize rich HTML server-side (bleach, DOMPurify).
• SameSite cookies + anti-CSRF token for state-changing requests; validate Origin/Referer on non-cookie APIs. CORS is a read-policy, not a write-policy — never rely on it to stop CSRF.
• SSRF: scheme + host allowlist; forbid user-supplied URLs to internal services; block link-local (169.254.169.254 metadata) and private ranges; disable redirects or re-validate each hop.

File uploads & command injection

• Validate extension and MIME and magic bytes (they must agree); random server-side filenames outside the web root; size limits; never execute uploads.
• Never interpolate input into shell strings — pass args as a list, or shlex.quote if a shell is unavoidable:

# Bad
os.system(f"ffmpeg -i {filename} out.mp4")
# Good
subprocess.run(["ffmpeg", "-i", filename, "out.mp4"], check=True)

Secrets Management

• Never hardcode secrets or commit real .env values — commit .env.example (placeholders only); .env* in .gitignore.
• Load from environment variables; use a secrets manager beyond trivial cases (AWS Secrets Manager/KMS, Vault, Doppler, 1Password).
• Scan for leaks in CI (gitleaks detect / trufflehog; GitHub/GitLab secret scanning); rotate on a schedule and immediately on leak; prefer short-lived, auto-rotating credentials.
• Keep secrets out of logs, errors, and stack traces.

Supply Chain Security

• Commit lockfiles (package-lock.json, yarn.lock, poetry.lock, uv.lock, hashed requirements.txt) for reproducible builds; generate an SBOM with syft/cyclonedx; use Dependabot/Renovate for automated updates.
• Scan dependencies on every PR in CI: pip-audit (Python), npm audit/pnpm audit (Node), osv-scanner (all), govulncheck (Go) — gate on high/critical.
• Watch for typosquatting and recently-published malicious packages; verify name and maintainer before adding dependencies.

Secure Defaults

• TLS everywhere: enforce HTTPS redirect + HSTS; never ship a disabled cert "for local testing".

• CORS: reflect only allowlisted origins; never Access-Control-Allow-Origin: * with Allow-Credentials: true; minimal Allow-Methods. Cookies: HttpOnly; Secure; SameSite=Lax minimum; __Host- prefix for session cookies.
• Errors: log full stack traces server-side; return generic messages ("Invalid credentials", "Internal server error"). Never expose DB errors, paths, framework versions, or "user not found" vs "wrong password". Debug off in prod (DEBUG=False, NODE_ENV=production).

Language Cheat-Sheets

Worked Example: Secure Login (FastAPI)

argon2id hashing, login rate limiting, timing-safe credential check without user enumeration, random sessions, hardened cookies:

import secrets
from datetime import datetime, timedelta, timezone

from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError
from fastapi import FastAPI, HTTPException, Request, Response
from slowapi import Limiter
from slowapi.util import get_remote_address

ph = PasswordHasher()                   # argon2id, OWASP params
DUMMY_HASH = ph.hash("not-a-real-password")   # timing parity for unknown users
limiter = Limiter(key_func=get_remote_address)
app = FastAPI()
app.state.limiter = limiter

@app.post("/login")
@limiter.limit("5/minute")              # per-IP rate limit
async def login(request: Request, response: Response, username: str, password: str):
    user = db.get_user(username)
    stored = user.password_hash if user else DUMMY_HASH
    try:
        ph.verify(stored, password)
        valid = user is not None
    except VerifyMismatchError:
        valid = False
    if not valid:
        raise HTTPException(401, detail="Invalid credentials")  # generic

    session_id = secrets.token_urlsafe(32)    # 256-bit random session id
    db.create_session(session_id, user.id,
                      expires_at=datetime.now(timezone.utc) + timedelta(hours=24))
    response.set_cookie("session", session_id,
                        httponly=True, secure=True, samesite="lax", max_age=86_400)
    return {"ok": True}

The unknown-user branch verifies a dummy hash so timing doesn't reveal valid usernames; the 401 body is identical for "no such user" and "wrong password". The cookie is HttpOnly (XSS-immune reads), Secure (HTTPS only), SameSite=Lax (CSRF-resistant), and the session row is revocable server-side on logout. For MFA, require a TOTP code from pyotp for admin accounts before issuing the session.

Anti-Patterns to Avoid

• Rolling your own crypto — use audited libraries; never invent algorithms, MACs, or password schemes.
• Storing passwords with fast hashes or reversible encryption — always argon2id/bcrypt.
• Committing secrets — real values in code, .env, or test fixtures are leaks, not config.
• Trusting client-supplied IDs, roles, or isAdmin flags — IDOR and privilege escalation by construction.
• eval, pickle, or yaml.load on untrusted input — code execution on demand.
• Skipping JWT verification (alg, exp, aud) — forged or expired tokens are as good as no auth.
• Returning stack traces / DB errors to users — information disclosure via the error path.
• Treating this skill as a tick-box checklist — prioritize by what attackers can reach; re-review when code changes.

When to Use / Not Use

Use this skill when:

• Reviewing new or existing Python, JS/TS, or Go code for security issues.
• Writing secure-by-default auth, sessions, or APIs (login flows, JWTs, OAuth2/OIDC).
• Fixing specific vulnerability classes: injection, XSS, IDOR, CSRF, SSRF, insecure deserialization, secrets in code.
• Setting up dependency scanning, lockfiles, SBOMs, or secret scanning in CI.
• Preparing code for a pen test, security audit, or production release ("is this safe to deploy?").

Not for:

• Compliance-only work (SOC 2/ISO 27001 evidence collection, policy documents) — this skill is about code, not certifications.
• Infrastructure-only security (network firewalls, Kubernetes hardening, cloud IAM architecture) — use a platform-specific skill.
• Designing novel cryptography — no skill replaces a cryptographer for new algorithms/protocols.
• General code review with no security angle — use a general code-review skill to avoid noise.
• Malware analysis / reverse engineering — a different tooling and threat model entirely.