jeffreytse/grimoire-core - 27ページ

design-error-handling

Use when designing how errors, exceptions, and failures are surfaced to users and logged internally — ensuring error messages don't leak sensitive implementation details while providing enough context for debugging.

原文の言語: 英語

design-mfa-system

Use when adding multi-factor authentication to an application — implementing TOTP, WebAuthn/passkeys, recovery codes, and phishing-resistant options for high-value accounts.

原文の言語: 英語

design-secure-sdlc

Use when establishing or improving a software development lifecycle — embedding security requirements, threat modeling, and security testing at each phase to find vulnerabilities when they cost 10× less to fix.

原文の言語: 英語

design-session-management

Use when implementing user authentication state — creating, storing, transmitting, and expiring session tokens or cookies in a web application.

原文の言語: 英語

design-supply-chain-security

Use when designing software supply chain security controls including SBOM generation, artifact signing, dependency management, and build pipeline integrity

原文の言語: 英語

design-threat-model

Use when designing a new system, reviewing architecture for security, adding an external-facing feature, handling sensitive data, or before a security audit.

原文の言語: 英語

design-zero-trust-architecture

Use when designing or migrating a security architecture to the zero trust model where no user, device, or network is trusted by default

原文の言語: 英語

prevent-clickjacking

Use when building any web page that performs state-changing actions on click — login forms, payment buttons, delete confirmations, or settings toggles that could be exploited if framed by an attacker.

原文の言語: 英語

prevent-credential-stuffing

Use when building login endpoints — detecting and blocking automated credential stuffing attacks using breached password detection, device fingerprinting, and bot detection.

原文の言語: 英語

prevent-csrf

Use when building any server-side endpoint that performs state-changing operations (POST, PUT, PATCH, DELETE) and is accessible by a browser session.

原文の言語: 英語

prevent-insecure-deserialization

Use when deserializing data from untrusted sources — user-submitted cookies, API request bodies, message queue payloads, or any format that reconstructs objects (pickle, Java serialization, YAML, PHP serialize).

原文の言語: 英語

prevent-mass-assignment

Use when binding HTTP request parameters or JSON bodies directly to model objects, database records, or data transfer objects — any place where user-supplied fields are mapped to internal properties.

原文の言語: 英語

prevent-open-redirect

Use when building any endpoint that redirects users based on a URL parameter — login redirects, logout returns, OAuth callback handling, or any redirect-after-action flow.

原文の言語: 英語

prevent-path-traversal

Use when building file upload, file download, file serving, or any feature where user input influences a filesystem path — including filename parameters, directory parameters, or file include logic.

原文の言語: 英語

prevent-redos

Use when writing or reviewing regular expressions that process user-controlled input — especially patterns with nested quantifiers, alternation with overlapping cases, or patterns applied to long strings.

原文の言語: 英語

prevent-sql-injection

Use when writing code that constructs database queries using any data that originates outside the application — user input, API parameters, headers, cookies, or environment variables.

原文の言語: 英語

prevent-ssrf

Use when building features that fetch URLs or make HTTP requests based on user-supplied input — web scrapers, webhook receivers, URL preview services, import-from-URL features, or any server-side HTTP client.

原文の言語: 英語

prevent-xss

Use when rendering user-supplied content in HTML, writing JavaScript that inserts data into the DOM, or building APIs whose responses are rendered in a browser.

原文の言語: 英語

prevent-xxe

Use when parsing XML in any context — file uploads, SOAP APIs, RSS/Atom feeds, SVG processing, document conversion, or any XML-based data exchange format.

原文の言語: 英語

review-authentication-security

Use when penetration testing or auditing authentication mechanisms — executing WSTG OTG-AUTHN test cases for username enumeration, brute force, default credentials, weak lockout, MFA bypass, and password reset flaws.

原文の言語: 英語

review-owasp-asvs

Use when auditing a web application's security posture against a structured verification standard — applying OWASP ASVS Level 1, 2, or 3 requirements to find and document security gaps across authentication, session management, access control, cryptography,…

原文の言語: 英語

review-owasp-checklist

Use when reviewing a new codebase for security, before a production launch, after a security incident, or during a compliance audit requiring OWASP Top 10 coverage.

原文の言語: 英語

review-secrets-management

Use when reviewing how secrets, credentials, API keys, or certificates are stored, rotated, and accessed in a system

原文の言語: 英語

review-session-management-security

Use when penetration testing or auditing session handling — executing WSTG OTG-SESS test cases for session token analysis, cookie attribute verification, CSRF, session fixation, and logout completeness.

原文の言語: 英語

validate-external-input

Use when writing code that accepts data from outside the process boundary — HTTP requests, file uploads, database reads, CLI arguments, environment variables, or inter-service calls — to reject malformed, malicious, or out-of-range data before it reaches…

原文の言語: 英語

apply-page-object-pattern

Use when writing UI automation or end-to-end tests to keep test logic decoupled from page implementation details, so tests remain maintainable when the UI changes.

原文の言語: 英語

fix-flaky-test

Use when a test passes and fails non-deterministically without code changes — to identify the root cause category (timing, shared state, concurrency, external dependency, randomness) and eliminate the flakiness rather than retrying or skipping the test.

原文の言語: 英語

write-integration-test

Use when writing tests that verify the interaction between two or more components, services, or external systems

原文の言語: 英語

write-unit-test

Use when writing a new unit test, reviewing tests for quality, adding tests to untested code, or when a test is fragile, slow, or hard to understand.

原文の言語: 英語

calculate-carbon-footprint

Use when quantifying greenhouse gas emissions for an organization, product, project, or activity to establish a baseline or report emissions.

原文の言語: 英語

apply-regenerative-agriculture

Use when designing or transitioning agricultural land management to practices that restore soil health, sequester carbon, and enhance biodiversity while maintaining or improving productivity.

原文の言語: 英語

audit-environmental-impact

Use when conducting a formal assessment of a project, facility, or operation's impacts on ecosystems, biodiversity, and natural resources.

原文の言語: 英語

audit-energy-consumption

Use when assessing a building, facility, or organization's energy use to identify waste, prioritize efficiency improvements, and establish a baseline for reduction targets.

原文の言語: 英語

design-energy-efficiency-plan

Use when developing a systematic plan to reduce energy consumption, improve energy performance, and achieve measurable efficiency targets for a facility, organization, or portfolio.

原文の言語: 英語

design-renewable-energy-system

Use when planning, sizing, or evaluating a renewable energy system (solar, wind, storage, or hybrid) for a facility, campus, or organization.

原文の言語: 英語

apply-circular-economy-principles

Use when redesigning products, services, or business models to eliminate waste, keep materials in use, and regenerate natural systems.

原文の言語: 英語

calculate-life-cycle-assessment

Use when evaluating the environmental impacts of a product, process, or service across its entire life cycle from raw material extraction to end of life.

原文の言語: 英語

design-sustainability-audit

Use when assessing an organization's environmental management practices, compliance status, and sustainability performance against recognized standards.

原文の言語: 英語

design-waste-reduction-program

Use when developing or improving an organization's systematic approach to minimizing waste generation, increasing diversion from landfill, and achieving zero waste targets.

原文の言語: 英語

design-water-conservation-program

Use when designing a systematic water conservation program for an organization, facility, or household to reduce water consumption, achieve compliance, or earn sustainability certification.

原文の言語: 英語