jeffreytse/grimoire-core - 27페이지

design-error-handling

Use when designing how errors, exceptions, and failures are surfaced to users and logged internally — ensuring error messages don't leak sensitive implementation details while providing enough context for debugging.

원문 언어: 영어

design-mfa-system

Use when adding multi-factor authentication to an application — implementing TOTP, WebAuthn/passkeys, recovery codes, and phishing-resistant options for high-value accounts.

원문 언어: 영어

design-secure-sdlc

Use when establishing or improving a software development lifecycle — embedding security requirements, threat modeling, and security testing at each phase to find vulnerabilities when they cost 10× less to fix.

원문 언어: 영어

design-session-management

Use when implementing user authentication state — creating, storing, transmitting, and expiring session tokens or cookies in a web application.

원문 언어: 영어

design-supply-chain-security

Use when designing software supply chain security controls including SBOM generation, artifact signing, dependency management, and build pipeline integrity

원문 언어: 영어

design-threat-model

Use when designing a new system, reviewing architecture for security, adding an external-facing feature, handling sensitive data, or before a security audit.

원문 언어: 영어

design-zero-trust-architecture

Use when designing or migrating a security architecture to the zero trust model where no user, device, or network is trusted by default

원문 언어: 영어

prevent-clickjacking

Use when building any web page that performs state-changing actions on click — login forms, payment buttons, delete confirmations, or settings toggles that could be exploited if framed by an attacker.

원문 언어: 영어

prevent-credential-stuffing

Use when building login endpoints — detecting and blocking automated credential stuffing attacks using breached password detection, device fingerprinting, and bot detection.

원문 언어: 영어

prevent-csrf

Use when building any server-side endpoint that performs state-changing operations (POST, PUT, PATCH, DELETE) and is accessible by a browser session.

원문 언어: 영어

prevent-insecure-deserialization

Use when deserializing data from untrusted sources — user-submitted cookies, API request bodies, message queue payloads, or any format that reconstructs objects (pickle, Java serialization, YAML, PHP serialize).

원문 언어: 영어

prevent-mass-assignment

Use when binding HTTP request parameters or JSON bodies directly to model objects, database records, or data transfer objects — any place where user-supplied fields are mapped to internal properties.

원문 언어: 영어

prevent-open-redirect

Use when building any endpoint that redirects users based on a URL parameter — login redirects, logout returns, OAuth callback handling, or any redirect-after-action flow.

원문 언어: 영어

prevent-path-traversal

Use when building file upload, file download, file serving, or any feature where user input influences a filesystem path — including filename parameters, directory parameters, or file include logic.

원문 언어: 영어

prevent-redos

Use when writing or reviewing regular expressions that process user-controlled input — especially patterns with nested quantifiers, alternation with overlapping cases, or patterns applied to long strings.

원문 언어: 영어

prevent-sql-injection

Use when writing code that constructs database queries using any data that originates outside the application — user input, API parameters, headers, cookies, or environment variables.

원문 언어: 영어

prevent-ssrf

Use when building features that fetch URLs or make HTTP requests based on user-supplied input — web scrapers, webhook receivers, URL preview services, import-from-URL features, or any server-side HTTP client.

원문 언어: 영어

prevent-xss

Use when rendering user-supplied content in HTML, writing JavaScript that inserts data into the DOM, or building APIs whose responses are rendered in a browser.

원문 언어: 영어

prevent-xxe

Use when parsing XML in any context — file uploads, SOAP APIs, RSS/Atom feeds, SVG processing, document conversion, or any XML-based data exchange format.

원문 언어: 영어

review-authentication-security

Use when penetration testing or auditing authentication mechanisms — executing WSTG OTG-AUTHN test cases for username enumeration, brute force, default credentials, weak lockout, MFA bypass, and password reset flaws.

원문 언어: 영어

review-owasp-asvs

Use when auditing a web application's security posture against a structured verification standard — applying OWASP ASVS Level 1, 2, or 3 requirements to find and document security gaps across authentication, session management, access control, cryptography,…

원문 언어: 영어

review-owasp-checklist

Use when reviewing a new codebase for security, before a production launch, after a security incident, or during a compliance audit requiring OWASP Top 10 coverage.

원문 언어: 영어

review-secrets-management

Use when reviewing how secrets, credentials, API keys, or certificates are stored, rotated, and accessed in a system

원문 언어: 영어

review-session-management-security

Use when penetration testing or auditing session handling — executing WSTG OTG-SESS test cases for session token analysis, cookie attribute verification, CSRF, session fixation, and logout completeness.

원문 언어: 영어

validate-external-input

Use when writing code that accepts data from outside the process boundary — HTTP requests, file uploads, database reads, CLI arguments, environment variables, or inter-service calls — to reject malformed, malicious, or out-of-range data before it reaches…

원문 언어: 영어

apply-page-object-pattern

Use when writing UI automation or end-to-end tests to keep test logic decoupled from page implementation details, so tests remain maintainable when the UI changes.

원문 언어: 영어

fix-flaky-test

Use when a test passes and fails non-deterministically without code changes — to identify the root cause category (timing, shared state, concurrency, external dependency, randomness) and eliminate the flakiness rather than retrying or skipping the test.

원문 언어: 영어

write-integration-test

Use when writing tests that verify the interaction between two or more components, services, or external systems

원문 언어: 영어

write-unit-test

Use when writing a new unit test, reviewing tests for quality, adding tests to untested code, or when a test is fragile, slow, or hard to understand.

원문 언어: 영어

calculate-carbon-footprint

Use when quantifying greenhouse gas emissions for an organization, product, project, or activity to establish a baseline or report emissions.

원문 언어: 영어

apply-regenerative-agriculture

Use when designing or transitioning agricultural land management to practices that restore soil health, sequester carbon, and enhance biodiversity while maintaining or improving productivity.

원문 언어: 영어

audit-environmental-impact

Use when conducting a formal assessment of a project, facility, or operation's impacts on ecosystems, biodiversity, and natural resources.

원문 언어: 영어

audit-energy-consumption

Use when assessing a building, facility, or organization's energy use to identify waste, prioritize efficiency improvements, and establish a baseline for reduction targets.

원문 언어: 영어

design-energy-efficiency-plan

Use when developing a systematic plan to reduce energy consumption, improve energy performance, and achieve measurable efficiency targets for a facility, organization, or portfolio.

원문 언어: 영어

design-renewable-energy-system

Use when planning, sizing, or evaluating a renewable energy system (solar, wind, storage, or hybrid) for a facility, campus, or organization.

원문 언어: 영어

apply-circular-economy-principles

Use when redesigning products, services, or business models to eliminate waste, keep materials in use, and regenerate natural systems.

원문 언어: 영어

calculate-life-cycle-assessment

Use when evaluating the environmental impacts of a product, process, or service across its entire life cycle from raw material extraction to end of life.

원문 언어: 영어

design-sustainability-audit

Use when assessing an organization's environmental management practices, compliance status, and sustainability performance against recognized standards.

원문 언어: 영어

design-waste-reduction-program

Use when developing or improving an organization's systematic approach to minimizing waste generation, increasing diversion from landfill, and achieving zero waste targets.

원문 언어: 영어

design-water-conservation-program

Use when designing a systematic water conservation program for an organization, facility, or household to reduce water consumption, achieve compliance, or earn sustainability certification.

원문 언어: 영어