security-checklist

What this skill does

# Security Checklist

## Overview

This skill provides comprehensive security guidance for building secure applications. Whether performing a security audit, implementing new features, or hardening existing systems, this framework helps identify and mitigate common vulnerabilities.

**When to use this skill:**
- Conducting security audits or reviews
- Implementing authentication and authorization
- Validating and sanitizing user input
- Handling sensitive data (PII, credentials, payment info)
- Ensuring compliance (GDPR, HIPAA, SOC2)
- Preparing for security assessments or penetration tests
- Reviewing third-party dependencies for vulnerabilities

## Required Tools

This skill requires the following tools to be installed on your system:

### For JavaScript/TypeScript Projects
- **Node.js 18+** with npm
- **Command:** `npm audit`
- **Install:** Node.js comes with npm pre-installed

### For Python Projects
- **Python 3.8+** with pip
- **pip-audit:** Security scanner for Python dependencies
  - **Install:** `pip install pip-audit`
  - **Command:** `pip-audit`

### Optional (Advanced Security Scanning)
- **Semgrep:** Static analysis tool
  - **Install (macOS):** `brew install semgrep`
  - **Install (pip):** `pip install semgrep`
  - **Command:** `semgrep --config=auto .`

- **Bandit:** Python security linter
  - **Install:** `pip install bandit`
  - **Command:** `bandit -r .`

- **TruffleHog:** Secrets detection
  - **Install (macOS):** `brew install trufflesecurity/trufflehog/trufflehog`
  - **Install (Go):** `go install github.com/trufflesecurity/trufflehog/v3@latest`
  - **Command:** `trufflehog filesystem .`

### Installation Verification
```bash
# Verify Node.js & npm
node --version
npm --version

# Verify Python & pip
python --version
pip --version

# Verify pip-audit
pip-audit --version

# Verify optional tools
semgrep --version
bandit --version
trufflehog --version
```

**Note:** The skill will automatically detect which tools are available and use appropriate commands for your project type.

## Security Principles

### Defense in Depth
- Multiple layers of security controls
- Assume each layer can fail, design redundancy
- Security at database, application, network, and infrastructure levels

### Least Privilege
- Grant minimum permissions necessary
- Separate read/write database accounts
- Service accounts with limited scope

### Fail Securely
- Errors don't expose sensitive information
- Authentication failures don't reveal if user exists
- Rate limiting prevents brute force attacks

### Don't Trust User Input
- **All** input is untrusted until validated
- Validate, sanitize, and escape
- Apply principle to query params, headers, cookies, POST data

---

## OWASP Top 10 (2021 Edition)

### 1. Broken Access Control

**Vulnerability**: Users can access resources they shouldn't.

**Examples:**
```python
# ❌ Bad: No authorization check
@app.route('/api/users/<user_id>')
def get_user(user_id):
    return db.query(f"SELECT * FROM users WHERE id = {user_id}")

# ✅ Good: Verify user can access this resource
@app.route('/api/users/<user_id>')
@login_required
def get_user(user_id):
    current_user = get_current_user()
    if current_user.id != user_id and not current_user.is_admin:
        abort(403, "Forbidden")
    return db.query("SELECT * FROM users WHERE id = ?", [user_id])
```

**Mitigations:**
- Deny by default (require explicit authorization)
- Enforce ownership checks (users can only access their own data)
- Implement RBAC (Role-Based Access Control)
- Test for IDOR (Insecure Direct Object References)
- Log access control failures

---

### 2. Cryptographic Failures

**Vulnerability**: Sensitive data exposed due to weak or missing encryption.

**Examples:**
```python
# ❌ Bad: Storing passwords in plaintext
user.password = request.form['password']

# ✅ Good: Hashing passwords with bcrypt
from bcrypt import hashpw, gensalt

hashed = hashpw(password.encode('utf-8'), gensalt())
user.password_hash = hashed

# ❌ Bad: Using weak hashing (MD5, SHA1)
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()

# ✅ Good: Using strong hashing (bcrypt, argon2, scrypt)
from argon2 import PasswordHasher

ph = PasswordHasher()
password_hash = ph.hash(password)
```

**Mitigations:**
- Use TLS/HTTPS for all traffic (enforce, not optional)
- Hash passwords with bcrypt, argon2, or scrypt
- Encrypt sensitive data at rest (PII, payment info)
- Never store credit card numbers (use tokenization)
- Use strong random number generators (`secrets` module in Python)
- Rotate encryption keys regularly

---

### 3. Injection (SQL, NoSQL, Command, LDAP)

**Vulnerability**: Untrusted data sent to an interpreter as part of a command.

**SQL Injection:**
```python
# ❌ Bad: String concatenation (vulnerable to SQL injection)
query = f"SELECT * FROM users WHERE email = '{email}'"
db.execute(query)

# ✅ Good: Parameterized queries
query = "SELECT * FROM users WHERE email = ?"
db.execute(query, [email])
```

**Command Injection:**
```python
# ❌ Bad: Shell=True with user input
import subprocess
filename = request.form['filename']
subprocess.run(f"cat {filename}", shell=True)

# ✅ Good: Avoid shell, use list arguments
subprocess.run(["cat", filename], shell=False)
```

**Mitigations:**
- Use parameterized queries (prepared statements)
- Use ORMs with proper query builders
- Validate and sanitize all input
- Avoid `eval()`, `exec()`, shell=True
- Use allowlists for permitted values
- Escape special characters in dynamic queries

---

### 4. Insecure Design

**Vulnerability**: Design flaws that can't be fixed with implementation.

**Examples:**
- No rate limiting on login/password reset
- Unlimited file upload sizes
- Sequential or guessable IDs
- Password reset without account verification

**Mitigations:**
- Threat modeling during design phase
- Rate limiting on all public endpoints
- Use UUIDs instead of sequential IDs for public resources
- Require email verification for password resets
- Implement CAPTCHA for sensitive operations
- Design for secure defaults (opt-in, not opt-out)

---

### 5. Security Misconfiguration

**Vulnerability**: Default configs, incomplete setups, verbose errors.

**Examples:**
```python
# ❌ Bad: Debug mode in production
app.debug = True

# ✅ Good: Debug mode only in development
app.debug = os.getenv('FLASK_ENV') == 'development'

# ❌ Bad: Verbose error messages
@app.errorhandler(Exception)
def handle_error(e):
    return str(e), 500  # Exposes stack traces

# ✅ Good: Generic error messages
@app.errorhandler(Exception)
def handle_error(e):
    logger.error(f"Error: {e}")
    return {"error": "Internal server error"}, 500
```

**Mitigations:**
- Disable debug mode in production
- Remove default credentials
- Close unnecessary ports and services
- Set security headers (CSP, X-Frame-Options, HSTS)
- Keep software updated (dependencies, frameworks, OS)
- Use environment variables for secrets (not hardcoded)

---

### 6. Vulnerable and Outdated Components

**Vulnerability**: Using libraries with known vulnerabilities.

**Mitigations:**
```bash
# Check for vulnerabilities
npm audit
npm audit fix

# Python
pip-audit
safety check
```

**Best Practices:**
- Pin dependency versions in lock files
- Scan dependencies regularly (CI/CD integration)
- Subscribe to security advisories (GitHub Dependabot, Snyk)
- Update dependencies regularly (monthly at minimum)
- Remove unused dependencies

---

### 7. Identification and Authentication Failures

**Vulnerability**: Weak authentication, credential stuffing, session hijacking.

**Examples:**
```python
# ❌ Bad: Weak password requirements
if len(password) < 6:
    return "Password too short"

# ✅ Good: Strong password requirements
import re

def validate_password(password):
    if len(password) < 12:
        return "Password must be at least 12 characters"
    if not re.search(r"[A-Z]", password):
        return "Password must contain uppercase letter"
    if not re.search(r"[a-z]", password):
        return