distribution-security

Defense-in-depth, PII protection, secrets scanning, and secure packaging for distributed software

Zur Installation springen

Repository: aibot88/sec_skill_store
Letzte Quellaktivität: 27. Mai 2026 um 03:47
Erkannte Sprache von SKILL.md: Englisch
Sterne: 3
Forks: 0

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Zurück zur Suche Zurück zur Installation

type	skill
lifecycle	stable
inheritance	inheritable
name	distribution-security
description	Defense-in-depth, PII protection, secrets scanning, and secure packaging for distributed software
tier	standard
applyTo	*/distribution,/security*
currency	2026-04-22T00:00:00.000Z
lastReviewed	2026-04-30T00:00:00.000Z

Distribution Security

Multi-layer security for software that ships to users — secrets scanning, permission minimization, and secure UI patterns.

Scope: Inheritable skill. Covers defense-in-depth architecture, PII protection, secrets scanning, permission minimization, CSP patterns, and secure WebView communication.

Defense-in-Depth Architecture

4-Layer Security Model

Every distributed application needs four independent security layers:

Layer	Function	Failure Mode
1. Authentication	Verify identity (OAuth, MSAL, API keys)	Unauthorized access
2. Authorization	Role-based access control (RBAC)	Privilege escalation
3. Secrets Scanning	Detect leaked credentials in source	Data breach
4. Audit Logging	Record all security-relevant events	Undetected compromise

Rule: Each layer must work independently. A failure in Layer 1 should not cascade — Layer 2 still blocks unauthorized actions, Layer 3 still catches leaked keys, Layer 4 still records the attempt.

PII Protection

3-Layer Exclusion Model

For projects that package and distribute source files:

Location	Allowed?	Alternative
Source code headers	No	Use team/org name
`package.json` author	Org name only

Personal Data Rules

Location	Allowed?	Alternative
Source code headers	No	Use team/org name
`package.json` author	Org name only

Pattern	Regex	Severity
API keys	`/[A-Za-z0-9_\-]{32,}/`	High
Connection strings	`/Server=.;[P]assword=./i`	Critical
JWT tokens	`/eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+/`	Critical
Private keys	`/-----BEGIN.*PRIVATE KEY-----/`	Critical
Azure keys	`/[A-Za-z0-9+/]{86}==/`	High

Context	Example	Action
Import statements	`import { KEY_LENGTH } from...`	Skip
Comments explaining patterns	`// API keys look like: abc123...`	Skip
Env variable definitions	`const API_KEY = process.env.KEY`	Skip (value is reference)
Test fixtures with dummy data	`const testKey = "test-key-1234"`	Skip if in test folder
Actual hardcoded secrets	`const key = "sk-live-abc123..."`	ALERT

Priority	Criteria	SLA
P0	Active secret exposure, data breach	Immediate (hours)
P1	Vulnerability in auth/authz layer	24 hours
P2	Missing security control (no CSP, etc.)	Sprint
P3	Best practice gap (logging format, etc.)	Backlog

Anti-pattern	Problem	Fix
Request `Mail.Send` for reading contacts	Users fear email spam	Request `Contacts.Read` only
Request admin scopes "for future use"	Over-privileged from day one	Request when feature ships
Broad `*` scopes	No granular control	Request specific sub-scopes

Anti-pattern	Problem	Secure Alternative
`onclick="handler()"`	Inline scripts violate CSP	`data-cmd` attribute + delegated listener
`eval()`	Code injection vector	Pre-compiled templates
`innerHTML = userInput`	XSS vulnerability	`textContent` or sanitized HTML
`<script src="cdn">`	External dependency risk	Bundle locally

<!-- Anti-pattern: inline handler (blocked by CSP) -->
<button onclick="doThing()">Click</button>

<!-- Secure: data-cmd + delegated listener -->
<button data-cmd="do-thing">Click</button>

<script>
  document.addEventListener('click', (e) => {
    const cmd = e.target.closest('[data-cmd]')?.dataset.cmd;
    if (cmd) handleCommand(cmd);
  });
</script>

Direction	Method	Example
Extension → WebView	`webview.postMessage(data)`	Send state updates
WebView → Extension	`vscode.postMessage(data)`	Report user actions
WebView → External URL	BLOCKED	`window.open()` silently fails
WebView → Local files	Via extension only	Request through message

// Extension side - validate WebView messages
panel.webview.onDidReceiveMessage((msg) => {
  if (!msg.type || typeof msg.type !== 'string') return;
  switch (msg.type) {
    case 'save': handleSave(msg.data); break;
    case 'navigate': handleNavigate(msg.url); break;
    // Ignore unknown message types
  }
});

Layer	Implementation	Purpose
1. Marker file	Presence of protection file blocks operation	Static guard
2. Confirmation dialog	"Are you sure?" prompt	User intent validation
3. Typed confirmation	User must type exact phrase	Prevent accidental clicks
4. Cooldown timer	Wait N seconds before enabling action	Prevent impulse actions
5. Audit log	Record who triggered what and when	Post-incident analysis

Tier	Coverage Target	What to Test
1. Auth/AuthZ	80%+ first	Token validation, role checks, permission gates
2. Input validation	80%+ next	Sanitization, bounds, injection prevention
3. Secrets handling	Full coverage	No secrets in logs, proper encryption
4. UI/cosmetic	After security	Layout, theming, preferences

Method	Covers	Misses
IaC scanning (Bicep/Terraform)	Declared resources	Manually created resources
`az resource list --subscription X`	All resources	Config drift within resources
Azure Policy + Defender	Compliance posture	Application-level vulns