| name | web-application-security |
| description | Use when auditing, planning, building, testing, or releasing browser-delivered applications, authenticated web systems, multi-tenant SaaS, upload-enabled applications, web APIs, or web applications involving payments, private data, AI, MCP/tools, OAuth, webhooks, or production security controls. |
| activation | Activate when the description trigger applies to the current task. |
| required_inputs | Task request, relevant repository context, constraints, and authority dependencies. |
| required_outputs | Skill-specific artifact, verification evidence, canonical verdict, and next action. |
| authority_dependencies | 00_start_here/SOURCE_OF_TRUTH.md; 10_governance/APIVR_EXECUTION_LIFECYCLE.md; 10_governance/source_of_truth/Elite_Build_Goals_v3.md. |
| evidence_requirements | Executed checks or an honest Unknown, Not Run, or Blocked state for every material claim. |
Web Application Security
Use this skill as the composite entry point for conventional web application security. Route through skills/cybersecurity-risk-routing/SKILL.md first when authorization, scope, live testing, or dual-use risk is uncertain.
Do not perform live scanning, exploitation, credential testing, cross-tenant probing, destructive tests, or testing outside the owned workspace without explicit authorization, written scope, targets, rules of engagement, stop conditions, and containment. Unknown core authentication, authorization, tenant-isolation, secret-exposure, or payment-integrity evidence blocks a production PASS.
Required Files
50_audits/WEB_APPLICATION_SECURITY_AUDIT.md40_knowledge/WEB_APPLICATION_SECURITY_CONTROL_MATRIX.md60_templates/WEB_APPLICATION_SECURITY_EVIDENCE_LEDGER_TEMPLATE.md10_governance/RELEASE_GATES.md40_knowledge/SECURITY_FRAMEWORK_MAPPING.md
APIVR Routing
- Phase 1 Audit: identify owner, source revision, environment, architecture, trust boundaries, data sensitivity, auth, tenancy, APIs, uploads, storage, providers, AI/tools, and authorization status.
- Phase 2 Plan: classify applicability, select audit tier and specialists, define safe negative tests, evidence, stop conditions, rollback/restoration, and release blockers.
- Phase 3 Implement: perform only approved defensive checks or narrowly implement controls with trusted-boundary enforcement, least privilege, safe fixtures, and redacted evidence.
- Phase 4 Audit Implementation: check scope drift, duplicate sources of truth, control ownership, negative-test coverage, runtime behavior, and evidence quality.
- Phase 5 Verify Implementation: run targeted static, integration, browser, provider-path, and recovery checks or record
Not Run / Blocked honestly.
- Phase 6 Re-Audit: classify residual risk, owners, expiration, reversal triggers, and final release verdict.
Control Ownership
This skill coordinates but does not duplicate specialist ownership:
| Surface | Route |
|---|
| AI, RAG, vector stores, prompts, model output | skills/ai-application-security/SKILL.md |
| MCP, connectors, filesystem, shell, network, tools | skills/mcp-tool-governance/SKILL.md |
| APIs, OAuth, webhooks, callbacks, rate limits |
