security-review

Security Review Skill

Gate-dominant security checklist for .NET 10 DDD/CQRS/ES back-end + Angular 22 front-end stack. Every clause is backed by an executable gate (build-blocking rule, CI scan, or unit test) or explicitly marked as manual-review-only.

When to Activate

• Implementing authentication or authorization in back-end commands/queries
• Adding command/query handlers with user input
• Creating database projections or aggregates handling sensitive data
• Implementing Angular components or services with form inputs
• Adding third-party NuGet or npm dependencies
• Writing new domain value objects with invariants

---

Part A: .NET 10 Back-End Security

1. Secrets Management

Gate: gitleaks pre-commit + full-history CI scan
Status: GATE TO WIRE

Rule: No API keys, connection strings, passwords, or tokens hardcoded in source. All secrets must be read via IConfiguration (appsettings.json / environment variables), user-secrets (dev), or Azure KeyVault (prod).

// ❌ WRONG
private const string ApiKey = "sk-proj-xxxxx";
private const string DbPassword = "password123";

// ✅ CORRECT
private readonly IConfiguration _config;

public MyService(IConfiguration config) => _config = config;

var apiKey = _config["External:ApiKey"]
  ?? throw new InvalidOperationException("External:ApiKey not configured");

Verification: Before committing, run gitleaks detect --verbose on staged files. CI must run full-history scan on every PR.

---

2. Input Validation at Command Boundary

Gate: FluentValidation + domain value-object invariants + unit/property tests
Status: GATE TO ADD (property-based tests via CsCheck)

Rule: All command inputs validated synchronously at the handler boundary via FluentValidation validators. Domain value objects enforce invariants via constructor throws. Property-based tests (CsCheck) confirm validators reject invalid inputs.

// FluentValidation at command boundary
public class CreateUserCommandValidator : AbstractValidator<CreateUserCommand>
{
    public CreateUserCommandValidator()
    {
        RuleFor(x => x.Email)
            .NotEmpty()
            .EmailAddress()
            .WithErrorCode("INVALID_EMAIL");

        RuleFor(x => x.Age)
            .InclusiveBetween(0, 150)
            .WithErrorCode("INVALID_AGE");
    }
}

// Domain invariant (value object constructor)
public class Email
{
    public string Value { get; }

    public Email(string value)
    {
        if (string.IsNullOrWhiteSpace(value) || !value.Contains("@"))
            throw new ArgumentException("Invalid email format", nameof(value));
        Value = value;
    }
}