| name | software-security-appsec |
| description | Modern application security patterns aligned with OWASP Top 10 (2021) and OWASP Top 10:2025 Release Candidate, OWASP API Security Top 10 (2023), NIST SSDF, zero trust, supply chain security, authentication, authorization, input validation, and cryptography. |
Software Security & AppSec — Quick Reference
Production-grade security patterns for building secure applications in Dec 2025. Covers OWASP Top 10 (stable 2021) https://owasp.org/www-project-top-ten/ and OWASP Top 10:2025 Release Candidate (preview) https://owasp.org/Top10/2025/, plus OWASP API Security Top 10 (2023) https://owasp.org/API-Security/ and secure SDLC baselines (NIST SSDF) https://csrc.nist.gov/publications/detail/sp/800-218/final.
When to Use This Skill
Activate this skill when:
- Implementing authentication or authorization systems
- Handling user input that could lead to injection attacks (SQL, XSS, command injection)
- Designing secure APIs or web applications
- Working with cryptographic operations or sensitive data storage
- Conducting security reviews, threat modeling, or vulnerability assessments
- Responding to security incidents or compliance audit requirements
- Building systems that must comply with OWASP, NIST, PCI DSS, GDPR, HIPAA, or SOC 2
- Integrating third-party dependencies (supply chain security review)
- Implementing zero trust architecture or modern cloud-native security patterns
- Establishing or improving secure SDLC gates (threat modeling, SAST/DAST, dependency scanning)
Quick Reference Table
| Security Task | Tool/Pattern | Implementation | When to Use |
|---|
| Password Storage | bcrypt/Argon2 | bcrypt.hash(password, 12) | Always hash passwords (never store plaintext) |
| Input Validation | Allowlist regex | /^[a-zA-Z0-9_]{3,20}$/ | All user input (SQL, XSS, command injection prevention) |
| SQL Queries | Parameterized queries | db.execute(query, [userId]) | All database operations (prevent SQL injection) |
| API Authentication | JWT + OAuth2 | jwt.sign(payload, secret, options) | Stateless auth with short-lived tokens (15-30 min) |
| Data Encryption | AES-256-GCM | crypto.createCipheriv('aes-256-gcm') | Sensitive data at rest (PII, financial, health) |
| HTTPS/TLS | TLS 1.3 | Force HTTPS redirects | All production traffic (data in transit) |
| Access Control | RBAC/ABAC | requireRole('admin', 'moderator') | Resource authorization (APIs, admin panels) |
| Rate Limiting | express-rate-limit | limiter({ windowMs: 15min, max: 100 }) | Public APIs, auth endpoints (DoS prevention) |
Decision Tree: Security Implementation
Security requirement: [Feature Type]
├─ User Authentication?
│ ├─ Session-based? → Cookie sessions + CSRF tokens
│ ├─ Token-based? → JWT with refresh tokens (resources/authentication-authorization.md)
│ └─ Third-party? → OAuth2/OIDC integration
│
├─ User Input?
│ ├─ Database query? → Parameterized queries (NEVER string concatenation)
│ ├─ HTML output? → DOMPurify sanitization + CSP headers
│ ├─ File upload? → Content validation, size limits, virus scanning
│ └─ API parameters? → Allowlist validation (resources/input-validation.md)
│
├─ Sensitive Data?
│ ├─ Passwords? → bcrypt/Argon2 (cost factor 12+)
│ ├─ PII/financial? → AES-256-GCM encryption + key rotation
│ ├─ API keys/tokens? → Environment variables + secrets manager
│ └─ In transit? → TLS 1.3 only
│
├─ Access Control?
│ ├─ Simple roles? → RBAC (templates/web-application/template-authorization.md)
│ ├─ Complex rules? → ABAC with policy engine
│ └─ Relationship-based? → ReBAC (owner, collaborator, viewer)
│
└─ API Security?
├─ Public API? → Rate limiting + API keys
├─ CORS needed? → Strict origin allowlist (never *)
└─ Headers? → Helmet.js (CSP, HSTS, X-Frame-Options)
Incident Response Patterns (Dec 2025)
Security Incident Playbook
| Phase | Actions |
|---|
| Detect | Alert fires, user report, automated scan |
| Contain | Isolate affected systems, revoke compromised credentials |
| Investigate | Collect logs, determine scope, identify root cause |
| Remediate | Patch vulnerability, rotate secrets, update defenses |
| Recover | Restore services, verify fixes, update monitoring |
| Learn | Post-mortem, update playbooks, share lessons |
Security Logging Requirements
| What to Log | Format | Retention |
|---|
| Authentication events | JSON with correlation ID | 90 days minimum |
| Authorization failures | JSON with user context | 90 days minimum |
| Data access (sensitive) | JSON with resource ID | 1 year minimum |
| Security scan results | SARIF format | 1 year minimum |
Do:
- Include correlation IDs across services
- Log to SIEM (Splunk, Datadog, ELK)
- Mask PII in logs
Avoid:
- Logging passwords, tokens, or keys
- Unstructured log formats
- Missing timestamps or context
Optional: AI/Automation Extensions
Note: Security considerations for AI systems. Skip if not building AI features.
LLM Security Patterns
| Threat | Mitigation |
|---|
| Prompt injection | Input validation, output filtering, sandboxed execution |
| Data exfiltration | Output scanning, PII detection |
| Model theft | API rate limiting, watermarking |
| Jailbreaking | Constitutional AI, guardrails |
AI-Assisted Security Tools
| Tool | Use Case |
|---|
| Semgrep | Static analysis with AI rules |
| Snyk Code | AI-powered vulnerability detection |
| GitHub CodeQL | Semantic code analysis |
.NET/EF Core Crypto Integration Security
For C#/.NET crypto/fintech services using Entity Framework Core, see:
Key rules summary:
- No secrets in code — use configuration/environment variables
- No sensitive data in logs (tokens, keys, PII)
- Use
decimal for financial values, never double/float
- EF Core or parameterized queries only — no dynamic SQL
- Generic error messages to users, detailed logging server-side
Navigation
Core Resources (Updated 2024-2025)
2025 Updates & Modern Architecture
Foundation Security Patterns
- resources/secure-design-principles.md — Defense in depth, least privilege, secure defaults
- resources/authentication-authorization.md — AuthN/AuthZ flows, OAuth 2.1, JWT best practices, RBAC/ABAC
- resources/input-validation.md — Allowlist validation, SQL injection, XSS, CSRF prevention, file upload security
- resources/cryptography-standards.md — AES-256-GCM, Argon2, TLS 1.3, key management
- resources/common-vulnerabilities.md — Path traversal, command injection, deserialization, SSRF
External References
Templates by Domain
Web Application Security
API Security
Cloud-Native Security
Blockchain & Web3 Security
Related Skills
Security Ecosystem
AI/LLM Security
Quality & Resilience
Operational Playbooks
