SecurityStandards

Security Standards

Implement security-first development practices with comprehensive threat protection, input validation, secure authentication, and data protection. This rule ensures all code follows security best practices and prevents common vulnerabilities.

Security-First Development Process

For every feature implementation, I will:

1. Threat Assessment: Identify potential security risks and attack vectors
2. Input Analysis: Catalog all user inputs and data sources requiring validation
3. Authentication Review: Ensure proper authentication and authorization controls
4. Data Protection: Implement encryption, sanitization, and secure data handling
5. Security Testing: Validate security measures and test for vulnerabilities
6. Monitoring Setup: Implement security logging and monitoring

Core Security Implementation Patterns

1. Comprehensive Input Validation Template

Use this pattern for all user input handling:

import { z } from 'zod';
import DOMPurify from 'dompurify';
import rateLimit from 'express-rate-limit';

// Schema-based validation with security constraints
const SecureUserInputSchema = z.object({
  email: z.string()
    .email('Invalid email format')
    .max(254, 'Email too long')
    .refine(email => !email.includes('<'), 'Invalid characters in email'),
  
  password: z.string()
    .min(12, 'Password must be at least 12 characters')
    .max(128, 'Password too long')
    .regex(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]/, 
           'Password must contain uppercase, lowercase, number, and special character'),
  
  name: z.string()
    .min(1, 'Name is required')
    .max(100, 'Name too long')
    .regex(/^[a-zA-Z\s\-'\.]+$/, 'Name contains invalid characters'),
  
  content: z.string()
    .max(5000, 'Content too long')
    .transform(content => DOMPurify.sanitize(content))
});

class SecureInputValidator {
  // Rate limiting middleware
  static createRateLimit(windowMs: number, max: number) {
    return rateLimit({
      windowMs,
      max,
      message: { error: 'Too many requests, please try again later' },
      standardHeaders: true,
      legacyHeaders: false,
      handler: (req, res) => {
        this.logSecurityEvent('rate_limit_exceeded', {
          ip: req.ip,
          userAgent: req.get('User-Agent'),
          endpoint: req.originalUrl
        });
        res.status(429).json({ error: 'Rate limit exceeded' });
      }
    });
  }

  // Comprehensive input validation
  static async validateInput<T>(
    schema: z.ZodSchema<T>,
    input: unknown,
    context: string
  ): Promise<T> {
    try {
      // Pre-validation security checks
      this.performSecurityChecks(input, context);
      
      // Schema validation
      const result = await schema.parseAsync(input);
      
      // Post-validation security verification
      this.verifySecurityConstraints(result, context);
      
      return result;
    } catch (error) {
      this.logSecurityEvent('input_validation_failed', {
        context,
        error: error.message,
        input: this.sanitizeForLogging(input)
      });
      throw new ValidationError('Invalid input provided');
    }
  }

  private static performSecurityChecks(input: unknown, context: string): void {
    const inputStr = JSON.stringify(input);
    
    // Check for common injection patterns
    const dangerousPatterns = [
      /<script/i,
      /javascript:/i,
      /on\w+\s*=/i,
      /union\s+select/i,
      /drop\s+table/i,
      /exec\s*\(/i,
      /eval\s*\(/i
    ];

    for (const pattern of dangerousPatterns) {
      if (pattern.test(inputStr)) {
        this.logSecurityEvent('malicious_input_detected', {
          context,
          pattern: pattern.source,
          input: this.sanitizeForLogging(input)
        });
        throw new SecurityError('Potentially malicious input detected');
      }
    }
  }

  private static verifySecurityConstraints<T>(result: T, context: string): void {
    // Additional security checks on validated data
    if (typeof result === 'object' && result !== null) {
      const resultStr = JSON.stringify(result);
      
      // Check for suspicious patterns in validated data
      if (resultStr.length > 100000) {
        throw new SecurityError('Input exceeds maximum size limits');
      }
    }
  }

  private static sanitizeForLogging(input: unknown): string {
    const inputStr = JSON.stringify(input);
    // Remove potentially sensitive data for logging
    return inputStr
      .replace(/("password":\s*")[^"]*"/gi, '$1[REDACTED]"')
      .replace(/("token":\s*")[^"]*"/gi, '$1[REDACTED]"')
      .replace(/("secret":\s*")[^"]*"/gi, '$1[REDACTED]"')
      .substring(0, 500); // Limit log size
  }

  private static logSecurityEvent(event: string, details: Record<string, any>): void {
    console.warn('SECURITY_EVENT', {
      timestamp: new Date().toISOString(),
      event,
      ...details
    });
  }
}