application-security

name	application-security
description	Secure applications against common vulnerabilities. Use when reviewing code for security, implementing security controls, or hardening applications. Covers OWASP Top 10.
allowed-tools	Read, Glob, Grep

Application Security

OWASP Top 10 (2021)

1. Broken Access Control

Risk: Users accessing unauthorized resources.

Prevention:

• Deny by default
• Implement RBAC/ABAC
• Validate permissions server-side
• Log access failures

2. Cryptographic Failures

Risk: Sensitive data exposure.

Prevention:

• Encrypt data at rest and in transit
• Use strong algorithms (AES-256, RSA-2048+)
• Never store passwords in plaintext
• Use secure key management

3. Injection

Risk: Malicious input executed as code.

Prevention:

// ❌ BAD - SQL injection vulnerability
@GetMapping("/users/{id}")
public User getUser(@PathVariable String id) {
    String query = "SELECT * FROM users WHERE id = " + id;
    return jdbcTemplate.queryForObject(query, User.class);
}

// ✅ GOOD - Use JPA/Spring Data (parameterized by default)
@Repository
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findById(Long id);
}

// ✅ GOOD - JPQL with named parameters
@Query("SELECT u FROM User u WHERE u.email = :email AND u.status = :status")
Optional<User> findByEmailAndStatus(
    @Param("email") String email,
    @Param("status") UserStatus status
);

// ❌ BAD - Command injection
Runtime.getRuntime().exec("ls " + userInput);

// ✅ GOOD - Use ProcessBuilder with separate arguments
ProcessBuilder pb = new ProcessBuilder("ls", userInput);
Process p = pb.start();

4. Insecure Design

Risk: Missing security controls by design.

Prevention:

• Threat modeling
• Security requirements
• Defense in depth

5. Security Misconfiguration

Risk: Default or weak configuration.

Prevention:

• Disable unnecessary features
• Remove default credentials
• Keep software updated
• Harden server configuration

6. Vulnerable Components

Risk: Using libraries with known vulnerabilities.

Prevention:

• Regular dependency audits
• Keep dependencies updated
• Monitor CVE databases

7. Authentication Failures

Risk: Weak or broken authentication.

Prevention:

• Multi-factor authentication
• Strong password policies
• Secure session management
• Rate limiting on login

8. Software & Data Integrity

Risk: Untrusted sources for updates.

Prevention:

• Verify code signatures
• Use SRI for CDN resources
• Secure CI/CD pipeline

9. Logging & Monitoring Failures

Risk: Attacks go undetected.

Prevention:

• Log security events
• Monitor for anomalies
• Alert on suspicious activity

10. Server-Side Request Forgery

Risk: Server makes requests to unintended destinations.

Prevention:

• Validate URLs
• Use allowlists
• Block internal IPs