Security Testing

Security & Testing

Security Principles

1. Defense in Depth: Multiple layers of security
2. Least Privilege: Minimum necessary permissions
3. Fail Secure: Default to deny
4. Zero Trust: Never trust, always verify

OWASP Top 10 Quick Reference

| # | Vulnerability | Prevention | |---|---------------|------------| | 1 | Broken Access Control | RBAC, deny by default, audit logs | | 2 | Cryptographic Failures | TLS, strong algorithms, key management | | 3 | Injection | Parameterized queries, input validation | | 4 | Insecure Design | Threat modeling, secure patterns | | 5 | Security Misconfiguration | Hardened defaults, minimal services | | 6 | Vulnerable Components | Dependency scanning, updates | | 7 | Auth/Identity Failures | MFA, session management | | 8 | Software/Data Integrity | Signed artifacts, CI/CD security | | 9 | Logging/Monitoring Failures | Centralized logs, alerting | | 10 | SSRF | Input validation, allowlists |

Security Checklist

• [ ] No hardcoded secrets
• [ ] Secrets not logged
• [ ] Input validation on all boundaries
• [ ] Parameterized queries
• [ ] Dependencies scanned for CVEs
• [ ] Authentication & authorization implemented
• [ ] HTTPS enforced
• [ ] Security headers configured
• [ ] Rate limiting in place
• [ ] Audit logging enabled

Testing Pyramid

        /\
       /  \     E2E Tests (few)
      /----\
     /      \   Integration Tests
    /--------\
   /          \ Unit Tests (many)
  /------------\

| Type | Purpose | Speed | Coverage | |------|---------|-------|----------| | Unit | Test isolated logic | Fast | High | | Integration | Test component interaction | Medium | Medium | | E2E | Test full user flows | Slow | Low |

Testing Best Practices

# Arrange-Act-Assert pattern
def test_user_creation():
    # Arrange
    user_data = {"name": "Alice", "email": "alice@acme.com"}
    
    # Act
    user = create_user(user_data)
    
    # Assert
    assert user.name == "Alice"
    assert user.email == "alice@acme.com"

# Test edge cases
def test_empty_input():
    with pytest.raises(ValueError):
        create_user({})

def test_invalid_email():
    with pytest.raises(ValidationError):
        create_user({"name": "Bob", "email": "invalid"})

API Security

# Essential security headers
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains

# Rate limiting
from flask_limiter import Limiter
limiter = Limiter(key_func=get_remote_address)

@app.route("/api/login")
@limiter.limit("5 per minute")
def login():
    pass

Observability

Three Pillars

| Pillar | Purpose | Tools | |--------|---------|-------| | Logs | Event records | ELK, CloudWatch | | Metrics | Numerical measurements | Prometheus, DataDog | | Traces | Request flows | Jaeger, X-Ray |

Structured Logging

logger.info("User action", extra={
    "user_id": user.id,
    "action": "login",
    "ip": request.remote_addr,
    "timestamp": datetime.utcnow().isoformat()
})

Detailed References

• OWASP Security: See [references/owasp-security.md](references/owasp-security.md)
• Identity & Access: See [references/identity-access.md](references/identity-access.md) for IAM, OIDC/PKCE, SAML/ADFS, PKI, PAM
• Testing Strategies: See [references/testing-strategies.md](references/testing-strategies.md)
• API Design: See [references/api-design.md](references/api-design.md)
• Observability: See [references/observability.md](references/observability.md)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: d-padmanabhan
• Source: d-padmanabhan/agent-engineering-handbook
• License: MIT

Install and usage instructions live in the source repository linked above.