Security Patterns

Systematic approach to identifying and remediating security vulnerabilities. Use this skill when: - Reviewing code for security vulnerabilities - Conducting security audits - Implementing authentication, authorization, or data handling - Assessing third-party dependencies

OWASP Top 10 (2021) Quick Detection

A01: Broken Access Control

Detection patterns: - Missing authorization checks on endpoints - Direct object references without ownership validation - Path traversal: ../ in file paths - CORS with Access-Control-Allow-Origin: * - JWT without signature verification

Remediation: - Implement RBAC/ABAC at controller/service layer - Validate ownership on every resource access - Use allowlists for file paths - Configure CORS with specific origins

A02: Cryptographic Failures

Detection patterns: - MD5/SHA1 for passwords - Hardcoded encryption keys - HTTP for sensitive data - Weak random: Math.random(), rand() - Missing encryption at rest

Remediation: - Use bcrypt/argon2 for passwords (cost ≥12) - External key management (KMS, Vault) - TLS 1.2+ everywhere - Cryptographic RNG only

A03: Injection

Detection patterns: - String concatenation in SQL/NoSQL queries - Template literals in HTML without escaping - eval(), exec(), Function() with user input - Shell commands with string interpolation - LDAP/XPath queries with user input

Remediation: - Parameterized queries always - Context-aware output encoding - Never eval untrusted input - Use ORM/query builders

A04: Insecure Design

Detection patterns: - Business logic without rate limiting - Missing account lockout - No CAPTCHA on authentication - Unbounded resource allocation - Missing threat model documentation

Remediation: - Rate limit all sensitive operations - Implement progressive delays - Bound all allocations - Document trust boundaries

A05: Security Misconfiguration

Detection patterns: - Default credentials in config - Verbose error messages to users - Debug mode in production - Unnecessary services enabled - Missing security headers

Remediation: - Automated hardening scripts - Generic error messages externally - Disable debug in production - Minimize attack surface

A06: Vulnerable Components

Detection patterns: - Dependencies with known CVEs - Outdated framework versions - Abandoned packages (no updates >2 years) - Single-maintainer critical deps

Remediation: - Automated dependency scanning - Regular update schedule - Evaluate package health before adoption - Pin specific versions with lockfiles

A07: Authentication Failures

Detection patterns: - Weak password requirements - Missing brute force protection - Session tokens in URL - No session timeout - Plain passwords in logs

Remediation: - Strong password policy - Account lockout/delays - Secure cookie flags - Session timeout <30 min idle - Never log credentials

A08: Data Integrity Failures

Detection patterns: - Deserialization of untrusted data - Missing integrity checks on downloads - Unsigned software updates - CI/CD without verification

Remediation: - Avoid native deserialization - Verify checksums/signatures - Sign all releases - Secure CI/CD pipeline

A09: Logging Failures

Detection patterns: - No logging on auth events - Sensitive data in logs - Logs without timestamps - No centralized logging - Missing alerting

Remediation: - Log all security events - Sanitize log data - Structured logging with timestamps - Centralize with retention policy

A10: SSRF

Detection patterns: - User-controlled URLs in server requests - Internal service access without validation - Cloud metadata endpoint accessible - URL parsing inconsistencies

Remediation: - Allowlist URLs/domains - Block internal IP ranges - Disable cloud metadata endpoint - Use URL parser consistently

Language-Specific Patterns

See detailed references: - references/javascript-vulnerabilities.md - references/python-vulnerabilities.md - references/java-vulnerabilities.md - references/go-vulnerabilities.md

Security Headers Checklist

STRIDE Threat Modeling