| name | security-testing |
| description | Use this skill when writing, reviewing, or planning security tests and vulnerability checks. Covers XSS, SQL injection, CSRF, IDOR, authentication/authorization testing, sensitive data exposure, HTTP security headers, and dependency auditing. Trigger when the user mentions security testing, vulnerability scanning, penetration testing, or any specific vulnerability type. |
Security Testing Skill
A reference for GitHub Copilot to identify security vulnerabilities and generate security-focused tests.
Common Vulnerability Checks
When to use: Identifying security risks in application code and configuration.
Prompting patterns:
Review [file/feature] for security vulnerabilities:
- Cross-site scripting (XSS) — user input rendered without sanitization
- SQL injection — raw queries with string interpolation
- Cross-site request forgery (CSRF) — state-changing requests without tokens
- Insecure direct object references (IDOR) — missing authorization checks
- Sensitive data exposure — secrets in code, logs, or responses
Authentication & Authorization Testing
Prompting patterns:
Write tests that verify:
- Unauthenticated users cannot access protected routes
- Users cannot access other users' data
- Token expiration is enforced
- Password requirements are validated
- Session invalidation works on logout
Best Practices
- Test authorization at the API level, not just the UI
- Verify that error messages don't leak information (e.g., "user not found" vs "invalid credentials")
- Check HTTP headers: CORS, Content-Security-Policy, X-Frame-Options
- Audit dependencies for known CVEs (
npm audit, snyk)
- Never log or expose sensitive data (tokens, passwords, PII) in test output
- Test for proper input sanitization on all user-facing inputs
- Verify that file uploads are validated (type, size, content)
- Check that API rate limiting is enforced
