Security Patterns

Security Patterns

Systematic approach to identifying and remediating security vulnerabilities. Use this skill when:

• Reviewing code for security vulnerabilities
• Conducting security audits
• Implementing authentication, authorization, or data handling
• Assessing third-party dependencies

OWASP Top 10 (2021) Quick Detection

A01: Broken Access Control

Detection patterns:

• Missing authorization checks on endpoints
• Direct object references without ownership validation
• Path traversal: ../ in file paths
• CORS with Access-Control-Allow-Origin: *
• JWT without signature verification

Remediation:

• Implement RBAC/ABAC at controller/service layer
• Validate ownership on every resource access
• Use allowlists for file paths
• Configure CORS with specific origins

A02: Cryptographic Failures

Detection patterns:

• MD5/SHA1 for passwords
• Hardcoded encryption keys
• HTTP for sensitive data
• Weak random: Math.random(), rand()
• Missing encryption at rest

Remediation:

• Use bcrypt/argon2 for passwords (cost ≥12)
• External key management (KMS, Vault)
• TLS 1.2+ everywhere
• Cryptographic RNG only

A03: Injection

Detection patterns:

• String concatenation in SQL/NoSQL queries
• Template literals in HTML without escaping
• eval(), exec(), Function() with user input
• Shell commands with string interpolation
• LDAP/XPath queries with user input

Remediation:

• Parameterized queries always
• Context-aware output encoding
• Never eval untrusted input
• Use ORM/query builders

A04: Insecure Design

Detection patterns:

• Business logic without rate limiting
• Missing account lockout
• No CAPTCHA on authentication
• Unbounded resource allocation
• Missing threat model documentation

Remediation:

• Rate limit all sensitive operations
• Implement progressive delays
• Bound all allocations
• Document trust boundaries

A05: Security Misconfiguration

Detection patterns:

• Default credentials in config
• Verbose error messages to users
• Debug mode in production
• Unnecessary services enabled
• Missing security headers

Remediation:

• Automated hardening scripts
• Generic error messages externally
• Disable debug in production
• Minimize attack surface

A06: Vulnerable Components

Detection patterns:

• Dependencies with known CVEs
• Outdated framework versions
• Abandoned packages (no updates >2 years)
• Single-maintainer critical deps

Remediation:

• Automated dependency scanning
• Regular update schedule
• Evaluate package health before adoption
• Pin specific versions with lockfiles

A07: Authentication Failures

Detection patterns:

• Weak password requirements
• Missing brute force protection
• Session tokens in URL
• No session timeout
• Plain passwords in logs

Remediation:

• Strong password policy
• Account lockout/delays
• Secure cookie flags
• Session timeout <30 min idle
• Never log credentials

A08: Data Integrity Failures

Detection patterns:

• Deserialization of untrusted data
• Missing integrity checks on downloads
• Unsigned software updates
• CI/CD without verification

Remediation:

• Avoid native deserialization
• Verify checksums/signatures
• Sign all releases
• Secure CI/CD pipeline

A09: Logging Failures

Detection patterns:

• No logging on auth events
• Sensitive data in logs
• Logs without timestamps
• No centralized logging
• Missing alerting

Remediation:

• Log all security events
• Sanitize log data
• Structured logging with timestamps
• Centralize with retention policy

A10: SSRF

Detection patterns:

• User-controlled URLs in server requests
• Internal service access without validation
• Cloud metadata endpoint accessible
• URL parsing inconsistencies

Remediation:

• Allowlist URLs/domains
• Block internal IP ranges
• Disable cloud metadata endpoint
• Use URL parser consistently

Language-Specific Patterns

See detailed references:

• references/javascript-vulnerabilities.md
• references/python-vulnerabilities.md
• references/java-vulnerabilities.md
• references/go-vulnerabilities.md

Security Headers Checklist

STRIDE Threat Modeling

Source: Cyborgninja21/pychivalry — distributed by TomeVault.