security-review

Files (1)

• SKILL.md

SKILL.md (first lines)

# Security Review

## OWASP Top 10 (2021)

Use this as a baseline checklist when reviewing any application for security vulnerabilities.

### A01: Broken Access Control

Users acting outside their intended permissions.

```javascript
// VULNERABLE: No authorization check
app.get('/api/users/:id', async (req, res) => {
  const user = await db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
  res.json(user);
});

// FIXED: Verify the requesting user has permission
app.get('/api/users/:id', authenticate, async (req, res) => {
  if (req.user.id !== req.params.id && req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  const user = await db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
  res.json(user);
});
```

### A02: Cryptographic Failures

- Use TLS 1.2+ for all data in transit. Hash passwords with bcrypt (cost 12+) or argon2.
- Never use MD5 or SHA-1 for password hashing. Encrypt data at rest with AES-256-GCM.

### A03: Injection

```python
# VULNERABLE: SQL injection via string concatenation
cursor.execute(f"SELECT * FROM users WHERE name = '{user_input}'")

# FIXED: Parameterized query
cursor.execute("SELECT * FROM users WHERE name = %s", (user_input,))
```

### A04: Insecure Design

- Rate limit authentication endpoints. Use CAPTCHA for public forms.
- Apply least privilege. Threat model before building, not after.

### A05: Security Misconfiguration

- Disable directory listing. Remove default credentials and demo accounts.
- Disable verbose errors in production. Review cloud IAM policies.

### A06: Vulnerable and Outdated Components

```bash
npm audit          # Node.js
pip-audit          # Python
bundle audit       # Ruby
```

### A07: Identification and Authentication Failures

- Enforce strong password policies (length over complexity). Account lockout after repeated failures.
- MFA for sensitive operations. Invalidate sessions on logout and password change.

### A08: Software and Data Integrity Failures

- Verify dependency integrity (lock files, checksums). Sign releases. Protect CI/CD pipelines.

### A09: Security Logging and Monitoring Failures

- Log all authentication events, authorization failures, and input validation failures.
- Ensure logs are tamper-proof and retained.

### A10: Server-Side Request Forgery (SSRF)

Application fetches a URL provided by the user without validation.

```javascript
// VULNERABLE: User controls the URL
app.get('/fetch', async (req, res) => {
  const response = await fetch(req.query.url);
  res.send(await response.text());
});

// FIXED: Allowlist of permitted domains
const ALLOWED_HOSTS = ['api.trusted-service.com'];
app.get('/fetch', async (req, res) => {
  const url = new URL(req.query.url);
  if (!ALLOWED_HOSTS.includes(url.hostname)) {
    return res.status(400).json({ error: 'Domain not allowed' });
  }
  res.send(await (await fetch(url.toString())).text());
});
```

## Authentication Patterns

### Password Hashing

```javascript
// Node.js with bcrypt
const bcrypt = require('bcrypt');
const SALT_ROUNDS = 12;
const hash = await bcrypt.hash(password, SALT_ROUNDS);          // Hash
const isValid = await bcrypt.compare(candidatePassword, storedHash); // Verify
```

```python
# Python with argon2
from argon2 import PasswordHasher
ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=4)
hash = ph.hash(password)           # Hash
ph.verify(hash, candidate_password) # Verify — raises VerifyMismatchError on failure
```

### Session Management

| Practice | Description |

From Claude-Code-Community-Ireland/claude-code-resources, MIT.

More from Claude-Code-Community-Ireland/claude-code-resources