Initial commit
This commit is contained in:
Zhongwei Li
330
skills/security-checklist/SKILL.md
Normal file
330
skills/security-checklist/SKILL.md
Normal file
@@ -0,0 +1,330 @@
|
||||
---
|
||||
description: Security review checklist for features and changes
|
||||
disable-model-invocation: false
|
||||
---
|
||||
|
||||
# Security Checklist
|
||||
|
||||
Comprehensive security review checklist for new features and changes.
|
||||
|
||||
## When to Use
|
||||
|
||||
- Before shipping any feature that handles user data
|
||||
- When implementing authentication or authorization
|
||||
- When adding new API endpoints
|
||||
- When integrating third-party services
|
||||
- During code review for security-sensitive changes
|
||||
|
||||
## Used By
|
||||
|
||||
- Security Engineer (primary owner)
|
||||
- Full-Stack Engineer (implementation)
|
||||
- Backend Engineer (API security)
|
||||
- DevOps Engineer (infrastructure security)
|
||||
|
||||
---
|
||||
|
||||
## Security Review Template
|
||||
|
||||
```markdown
|
||||
# Security Review: [Feature/Change Name]
|
||||
|
||||
**Reviewer**: [Name]
|
||||
**Date**: [Date]
|
||||
**Status**: In Progress | Approved | Needs Changes
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
### Feature Description
|
||||
[Brief description of the feature]
|
||||
|
||||
### Data Handled
|
||||
- [ ] PII (Personal Identifiable Information)
|
||||
- [ ] Financial data
|
||||
- [ ] Authentication credentials
|
||||
- [ ] User-generated content
|
||||
- [ ] None of the above
|
||||
|
||||
### Risk Level
|
||||
- [ ] High (handles sensitive data, authentication, payments)
|
||||
- [ ] Medium (user data, API endpoints)
|
||||
- [ ] Low (display only, no data mutation)
|
||||
|
||||
---
|
||||
|
||||
## Authentication & Authorization
|
||||
|
||||
### Authentication
|
||||
- [ ] Authentication required for all protected endpoints
|
||||
- [ ] Session management is secure (httpOnly, secure, sameSite)
|
||||
- [ ] Token expiration is appropriate
|
||||
- [ ] Logout properly invalidates session
|
||||
- [ ] No authentication bypass possible
|
||||
|
||||
### Authorization
|
||||
- [ ] Authorization checked on every request
|
||||
- [ ] Users can only access their own data
|
||||
- [ ] Admin functions properly protected
|
||||
- [ ] Role/permission checks in place
|
||||
- [ ] No IDOR (Insecure Direct Object Reference) vulnerabilities
|
||||
|
||||
### Multi-Factor Authentication (if applicable)
|
||||
- [ ] MFA enforced for sensitive operations
|
||||
- [ ] MFA bypass not possible
|
||||
- [ ] Recovery codes handled securely
|
||||
|
||||
---
|
||||
|
||||
## Input Validation
|
||||
|
||||
### Data Validation
|
||||
- [ ] All user input validated on server side
|
||||
- [ ] Input type checked (string, number, etc.)
|
||||
- [ ] Input length limited appropriately
|
||||
- [ ] Input format validated (email, URL, etc.)
|
||||
- [ ] Allowlists preferred over blocklists
|
||||
|
||||
### SQL Injection
|
||||
- [ ] Parameterized queries used (no string concatenation)
|
||||
- [ ] ORM used correctly
|
||||
- [ ] Raw queries reviewed for injection
|
||||
|
||||
### XSS (Cross-Site Scripting)
|
||||
- [ ] Output encoded for context (HTML, JS, URL, CSS)
|
||||
- [ ] User content sanitized before display
|
||||
- [ ] Content Security Policy configured
|
||||
- [ ] No dangerous `innerHTML` or `dangerouslySetInnerHTML`
|
||||
|
||||
### Command Injection
|
||||
- [ ] No user input passed to shell commands
|
||||
- [ ] If necessary, input strictly validated
|
||||
- [ ] Parameterized execution used
|
||||
|
||||
---
|
||||
|
||||
## Data Protection
|
||||
|
||||
### Data at Rest
|
||||
- [ ] Sensitive data encrypted in database
|
||||
- [ ] Encryption keys properly managed
|
||||
- [ ] PII minimized (don't store what you don't need)
|
||||
- [ ] Data classified and tagged
|
||||
|
||||
### Data in Transit
|
||||
- [ ] HTTPS enforced everywhere
|
||||
- [ ] TLS 1.2+ required
|
||||
- [ ] HSTS enabled
|
||||
- [ ] Secure cookies (httpOnly, secure, sameSite)
|
||||
|
||||
### Data Handling
|
||||
- [ ] Sensitive data not logged
|
||||
- [ ] Error messages don't expose internal details
|
||||
- [ ] Data scrubbed from error reports
|
||||
- [ ] Secure data deletion implemented
|
||||
|
||||
---
|
||||
|
||||
## API Security
|
||||
|
||||
### Endpoint Security
|
||||
- [ ] Rate limiting implemented
|
||||
- [ ] Request size limits set
|
||||
- [ ] Timeout configured
|
||||
- [ ] CORS properly configured
|
||||
|
||||
### Request Validation
|
||||
- [ ] Schema validation on all inputs
|
||||
- [ ] Unexpected fields rejected or ignored
|
||||
- [ ] Content-type verified
|
||||
- [ ] File upload restrictions in place
|
||||
|
||||
### Response Security
|
||||
- [ ] Sensitive data not in responses
|
||||
- [ ] Error codes don't leak information
|
||||
- [ ] Consistent error format
|
||||
- [ ] No stack traces in production
|
||||
|
||||
---
|
||||
|
||||
## Third-Party Security
|
||||
|
||||
### Dependencies
|
||||
- [ ] Dependencies scanned for vulnerabilities
|
||||
- [ ] Dependencies from trusted sources
|
||||
- [ ] Dependencies up to date
|
||||
- [ ] Lock file used (package-lock.json, etc.)
|
||||
|
||||
### Integrations
|
||||
- [ ] Third-party credentials properly managed
|
||||
- [ ] API keys not in code
|
||||
- [ ] Webhook signatures verified
|
||||
- [ ] Third-party responses validated
|
||||
|
||||
---
|
||||
|
||||
## Infrastructure Security
|
||||
|
||||
### Secrets Management
|
||||
- [ ] No secrets in code
|
||||
- [ ] Secrets in environment variables or secret manager
|
||||
- [ ] Secrets rotated regularly
|
||||
- [ ] Access to secrets logged
|
||||
|
||||
### Security Headers
|
||||
- [ ] Content-Security-Policy
|
||||
- [ ] X-Content-Type-Options: nosniff
|
||||
- [ ] X-Frame-Options or CSP frame-ancestors
|
||||
- [ ] Referrer-Policy
|
||||
- [ ] Permissions-Policy
|
||||
- [ ] Strict-Transport-Security
|
||||
|
||||
### Error Handling
|
||||
- [ ] Generic error pages in production
|
||||
- [ ] No stack traces exposed
|
||||
- [ ] Errors logged server-side
|
||||
- [ ] Monitoring for unusual error patterns
|
||||
|
||||
---
|
||||
|
||||
## Logging & Monitoring
|
||||
|
||||
### Security Logging
|
||||
- [ ] Authentication attempts logged
|
||||
- [ ] Authorization failures logged
|
||||
- [ ] Sensitive operations logged
|
||||
- [ ] Logs don't contain sensitive data
|
||||
- [ ] Log integrity protected
|
||||
|
||||
### Monitoring
|
||||
- [ ] Alerts for suspicious activity
|
||||
- [ ] Failed login monitoring
|
||||
- [ ] Rate limit triggers monitored
|
||||
- [ ] Error rate monitoring
|
||||
|
||||
---
|
||||
|
||||
## Threat Model
|
||||
|
||||
### Assets
|
||||
[What data/functionality are we protecting?]
|
||||
|
||||
### Threat Actors
|
||||
- [ ] Anonymous attackers
|
||||
- [ ] Authenticated users (privilege escalation)
|
||||
- [ ] Malicious insiders
|
||||
- [ ] Automated bots/scrapers
|
||||
|
||||
### Attack Vectors
|
||||
| Threat | Likelihood | Impact | Mitigation |
|
||||
|--------|------------|--------|------------|
|
||||
| [Threat 1] | H/M/L | H/M/L | [Control] |
|
||||
| [Threat 2] | H/M/L | H/M/L | [Control] |
|
||||
|
||||
### Residual Risks
|
||||
[Risks that are accepted with justification]
|
||||
|
||||
---
|
||||
|
||||
## Findings
|
||||
|
||||
### Critical (Must Fix)
|
||||
- [ ] [Finding 1]
|
||||
- [ ] [Finding 2]
|
||||
|
||||
### High (Should Fix)
|
||||
- [ ] [Finding 1]
|
||||
- [ ] [Finding 2]
|
||||
|
||||
### Medium (Recommend)
|
||||
- [ ] [Finding 1]
|
||||
|
||||
### Informational
|
||||
- [Note 1]
|
||||
|
||||
---
|
||||
|
||||
## Sign-Off
|
||||
|
||||
| Role | Name | Date | Status |
|
||||
|------|------|------|--------|
|
||||
| Security | | | [ ] Approved |
|
||||
| Dev Lead | | | [ ] Acknowledged |
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## OWASP Top 10 Quick Reference
|
||||
|
||||
### 1. Broken Access Control
|
||||
- Enforce access control on server
|
||||
- Deny by default
|
||||
- Verify ownership of resources
|
||||
|
||||
### 2. Cryptographic Failures
|
||||
- Encrypt sensitive data
|
||||
- Use strong algorithms
|
||||
- Manage keys securely
|
||||
|
||||
### 3. Injection
|
||||
- Use parameterized queries
|
||||
- Validate and sanitize input
|
||||
- Escape output for context
|
||||
|
||||
### 4. Insecure Design
|
||||
- Threat model new features
|
||||
- Defense in depth
|
||||
- Secure defaults
|
||||
|
||||
### 5. Security Misconfiguration
|
||||
- Disable unnecessary features
|
||||
- Secure default configs
|
||||
- Remove default credentials
|
||||
|
||||
### 6. Vulnerable Components
|
||||
- Scan dependencies
|
||||
- Keep updated
|
||||
- Monitor for vulnerabilities
|
||||
|
||||
### 7. Authentication Failures
|
||||
- Strong password requirements
|
||||
- Secure session management
|
||||
- Multi-factor authentication
|
||||
|
||||
### 8. Software/Data Integrity Failures
|
||||
- Verify dependencies
|
||||
- Sign releases
|
||||
- Secure CI/CD
|
||||
|
||||
### 9. Security Logging Failures
|
||||
- Log security events
|
||||
- Protect log integrity
|
||||
- Monitor for anomalies
|
||||
|
||||
### 10. Server-Side Request Forgery (SSRF)
|
||||
- Validate URLs
|
||||
- Use allowlists
|
||||
- Limit outbound requests
|
||||
|
||||
---
|
||||
|
||||
## Quick Security Checks
|
||||
|
||||
### Before Every PR
|
||||
- [ ] No secrets in code
|
||||
- [ ] Input validation present
|
||||
- [ ] Auth checks in place
|
||||
- [ ] No obvious injection vectors
|
||||
|
||||
### Before Every Release
|
||||
- [ ] Dependency scan clean
|
||||
- [ ] Security headers configured
|
||||
- [ ] Authentication tested
|
||||
- [ ] Authorization tested
|
||||
|
||||
### Quarterly
|
||||
- [ ] Full security review
|
||||
- [ ] Penetration testing
|
||||
- [ ] Dependency update
|
||||
- [ ] Access review
|
||||
Reference in New Issue
Block a user