security

Security Patterns

Domain expertise for security vulnerability detection. Use alongside devflow:review-methodology for complete security reviews.

Iron Law

ASSUME ALL INPUT IS MALICIOUS

Every user input, URL parameter, header, and cookie is an attack vector. Use parameterized queries always. Escape output always. Validate schemas always. "This field is internal" is not a defense. Defense in depth, not wishful thinking. [1][6]

Vulnerability Categories

1. Input Validation & Injection [1][6]

SQL Injection — parameterize, never interpolate:

// VULNERABLE: const query = `SELECT * FROM users WHERE email = '${email}'`;
await db.execute("SELECT * FROM users WHERE email = ?", [email]);

XSS — text content, never innerHTML:

element.textContent = userInput;  // not: element.innerHTML = userInput

references/patterns.md — NoSQL, command injection, path traversal, LDAP injection.

2. Authentication & Authorization [1][2][7]

// VULNERABLE: no auth middleware
app.delete('/api/users/:id', async (req, res) => { await deleteUser(req.params.id); });

// SECURE: layered auth
app.delete('/api/users/:id', requireAuth, requireRole('admin'), handler);

NIST 800-63 minimum: 15-char passphrase or 12-char complex, phishing-resistant MFA [7]. JWT: pin algorithm explicitly, set expiresIn, store refresh tokens server-side [17].

3. Cryptography & Secrets [5][24][25]

const API_KEY = process.env.API_KEY;           // not: hardcoded literal
const token = crypto.randomBytes(32).toString('hex');  // not: Math.random()

Password hashing: Argon2id (preferred) or bcrypt cost ≥12 [24]. Encrypt with AES-256-GCM (authenticated). Compare secrets with crypto.timingSafeEqual, never === [25].

Reporting a found secret: cite file:line and the type slug — never quote the full value. Use {first ≤4 chars}…[REDACTED:{type}] (e.g. AKID…[REDACTED:aws-key]). A found live credential is ALREADY COMPROMISED — the remediation is rotation (revoke and regenerate the exposed credential) plus moving to env vars or a secret store, not just removal from code.