security-review

Files (2)

• SKILL.md
• cloud-infrastructure-security.md

SKILL.md (first lines)

# Security Review Skill

Gate-dominant security checklist for .NET 10 DDD/CQRS/ES back-end + Angular 22 front-end stack. Every clause is backed by an executable gate (build-blocking rule, CI scan, or unit test) or explicitly marked as manual-review-only.

## When to Activate

- Implementing authentication or authorization in back-end commands/queries
- Adding command/query handlers with user input
- Creating database projections or aggregates handling sensitive data
- Implementing Angular components or services with form inputs
- Adding third-party NuGet or npm dependencies
- Writing new domain value objects with invariants

---

## Part A: .NET 10 Back-End Security

### 1. Secrets Management

**Gate**: `gitleaks` pre-commit + full-history CI scan  
**Status**: `GATE TO WIRE`

**Rule**: No API keys, connection strings, passwords, or tokens hardcoded in source. All secrets must be read via `IConfiguration` (appsettings.json / environment variables), user-secrets (dev), or Azure KeyVault (prod).

```csharp
// ❌ WRONG
private const string ApiKey = "sk-proj-xxxxx";
private const string DbPassword = "password123";

// ✅ CORRECT
private readonly IConfiguration _config;

public MyService(IConfiguration config) => _config = config;

var apiKey = _config["External:ApiKey"]
  ?? throw new InvalidOperationException("External:ApiKey not configured");
```

**Verification**: Before committing, run `gitleaks detect --verbose` on staged files. CI must run full-history scan on every PR.

---

### 2. Input Validation at Command Boundary

**Gate**: FluentValidation + domain value-object invariants + unit/property tests  
**Status**: `GATE TO ADD` (property-based tests via CsCheck)

**Rule**: All command inputs validated synchronously at the handler boundary via FluentValidation validators. Domain value objects enforce invariants via constructor throws. Property-based tests (CsCheck) confirm validators reject invalid inputs.

```csharp
// FluentValidation at command boundary
public class CreateUserCommandValidator : AbstractValidator<CreateUserCommand>
{
    public CreateUserCommandValidator()
    {
        RuleFor(x => x.Email)
            .NotEmpty()
            .EmailAddress()
            .WithErrorCode("INVALID_EMAIL");

        RuleFor(x => x.Age)
            .InclusiveBetween(0, 150)
            .WithErrorCode("INVALID_AGE");
    }
}

// Domain invariant (value object constructor)
public class Email
{
    public string Value { get; }

    public Email(string value)
    {
        if (string.IsNullOrWhiteSpace(value) || !value.Contains("@"))
            throw new ArgumentException("Invalid email format", nameof(value));
        Value = value;
    }
}
```

**Verification**: Unit tests confirm validator rejects each invalid case; property-based tests (CsCheck) generate random invalid inputs and confirm rejection.

---

### 3. SQL Injection Prevention

**Gate**: Roslyn CA2100 (build-blocking) + SAST rule for interpolated `*SqlRaw` calls  
**Status**: `GATE TO WIRE` (Roslyn CA2100 enabled; SAST rule for raw SQL patterns)

**Rule**: EF Core parameterizes by default. **Forbidden**: `FromSqlRaw()` and `ExecuteSqlRaw()` with string interpolation or concatenation. Use only `FromSqlInterpolated()` or parameterized `*Async` with explicit parameter arrays.

```csharp
// ❌ DANGEROUS
var query = $"SELECT * FROM users WHERE email = '{userEmail}'";
context.Users.FromSqlRaw(query).ToList();

// ✅ CORRECT
var results = context.Users
    .FromSqlInterpolated($"SELECT * FROM users WHERE email = {userEmail}")
    .ToList();

// ✅ ALSO CORRECT (explicit parameters)
var results = await context.Users
    .FromSqlAsync(
        "SELECT * FROM users WHERE email = @email",
        new SqlParameter("@email", userEmail)
    )
    .ToListAsync();
```

**Verification**: Build fails if CA2100 triggered. SAST scan flags interpolated `*SqlRaw` calls.

---

### 4. Tenant Isolation & Row-Level Security (RLS)

**Gate**: `DbConnectionInterceptor` + `FORCE ROW LEVEL SECURITY` + RLS coverage test  
**Status**: `GATE TO ADD` (coverage test; choke point exists in `backend/src/GcPlatform.Api/Infrastructure/Persistence/TenantSessionInterceptor.cs`)

From fmflurry/settings-opencode, MIT.

More from fmflurry/settings-opencode