security

name	security
description	Security audit workflow - OWASP Top 10, input validation, auth, secret detection, vulnerability scan

Security Patterns

OWASP Top 10 (2021) Checklist

#	Vulnerability	Prevention
A01	Broken Access Control	RBAC, resource-level auth, CORS
A02	Cryptographic Failures	Encrypt at rest/transit, no PII in logs
A03	Injection (SQL/NoSQL/XSS/OS)	Parameterized queries, output encoding, CSP
A04	Insecure Design	Threat modeling, secure design patterns
A05	Security Misconfiguration	Hardened defaults, no debug in prod
A06	Vulnerable Components	npm audit, dependency scan, CVE tracking
A07	Auth Failures	Rate limiting, MFA, secure session
A08	Data Integrity Failures	Input validation, signed updates, CI/CD security
A09	Logging & Monitoring Failures	Audit log, alert on anomaly
A10	SSRF	URL allowlist, network segmentation

Input Validation

import { z } from 'zod';

const UserInput = z.object({
  email: z.string().email().max(255),
  name: z.string().min(1).max(100).regex(/^[\w\s-]+$/),
  age: z.number().int().min(0).max(150),
});

// Parameterized query (SQL injection prevention)
const user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);

Auth Best Practices

// Password hashing
import bcrypt from 'bcryptjs';
const hash = await bcrypt.hash(password, 12);
const valid = await bcrypt.compare(password, hash);

// JWT with expiry
const token = jwt.sign({ userId: user.id, role: user.role }, secret, { expiresIn: '24h' });

// Rate limiting on auth endpoints
const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });
app.use('/api/auth', authLimiter);

Secret Detection

# Git hooks ile secret engelleme
grep -rn "sk-\|pk_\|ghp_\|xoxb-\|AKIA" --include="*.ts" --include="*.js" src/
grep -rn "password\s*=\s*['\"]" --include="*.ts" src/

Security Headers

import helmet from 'helmet';
app.use(helmet());
// Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, etc.

Anti-Patterns

Anti-Pattern	Cozum
Hardcoded secrets	Environment variables
SQL string concat	Parameterized queries
No CORS config	Whitelist origins
Debug mode in prod	NODE_ENV check
No rate limiting	express-rate-limit

Pentest Methodology (Overview)

Detayli rehber icin: pentest-methodology skill

5-faz pipeline: Recon > Vuln Analysis > Exploitation > Verification > Report

Proof Levels

Level	Tanim
L1 - Theoretical	Potansiyel risk, exploit edilmemis
L2 - Demonstrated	Bypass/leak gosterildi
L3 - Exploited	Tam exploit, veri erisimi
L4 - Chained	Birden fazla vuln zincirlendi

Source-to-Sink Taint Tracing

Kullanici input'unun (source) tehlikeli fonksiyona (sink) ulasip ulasamadigini kontrol et:

Source: req.body, req.query, req.params, req.headers, cookies
Sink: db.query(), eval(), exec(), res.redirect(), innerHTML

Kontrol: Source ile Sink arasinda sanitizasyon/validasyon var mi?

Bu yaklasimi her code review'da auth/data islerinde kullan.