Appsec Expert

Application Security Expert

0. Anti-Hallucination Protocol

🚨 MANDATORY: Read before implementing any code using this skill

Verification Requirements

When using this skill to implement security features, you MUST:

1. Verify Before Implementing

• ✅ Check official documentation for all security APIs
• ✅ Confirm configuration options exist in target framework
• ✅ Validate OWASP guidance is current (2025 version)
• ❌ Never guess security method signatures
• ❌ Never invent configuration options
• ❌ Never assume security defaults

1. Use Available Tools

• 🔍 Read: Check existing codebase for security patterns
• 🔍 Grep: Search for similar security implementations
• 🔍 WebSearch: Verify APIs in official security docs
• 🔍 WebFetch: Read OWASP guides and library documentation

1. **Verify if Certainty alert(1)")

def testsanitizeshtmloutput(self): """Must escape HTML characters""" result = InputValidator.sanitizehtml("alert(1)") assert "" not in result assert "<script>" in result

### Step 2: Implement Minimum Security Control

```python
# app/auth.py - Implement to pass tests
from argon2 import PasswordHasher

class SecureAuth:
    def __init__(self):
        self.ph = PasswordHasher(time_cost=3, memory_cost=65536)

    def hash_password(self, password: str) -> str:
        if len(password)  list:
    results = []
    for file_path in changed_files:
        if file_path.endswith(('.py', '.js', '.ts')):
            results.extend(run_semgrep(file_path))
    return results

# Bad: Full codebase scan on every commit
def full_scan():
    return run_semgrep(".")  # Slow for large codebases

Pattern 2: Cache Security Results

# Good: Cache scan results with file hash
import hashlib
from functools import lru_cache

@lru_cache(maxsize=1000)
def cached_vulnerability_check(file_hash: str, rule_version: str):
    return run_security_scan(file_hash)

def scan_with_cache(file_path: str):
    content = Path(file_path).read_bytes()
    file_hash = hashlib.sha256(content).hexdigest()
    return cached_vulnerability_check(file_hash, RULE_VERSION)

# Bad: Re-scan unchanged files
def scan_without_cache(file_path: str):
    return run_security_scan(file_path)  # Redundant work

Pattern 3: Parallel Security Analysis

# Good: Parallel scanning with thread pool
from concurrent.futures import ThreadPoolExecutor

def parallel_security_scan(files: list[str], max_workers: int = 4):
    with ThreadPoolExecutor(max_workers=max_workers) as executor:
        results = list(executor.map(scan_single_file, files))
    return [r for r in results if r]

# Bad: Sequential scanning
def sequential_scan(files: list[str]):
    results = []
    for f in files:
        results.append(scan_single_file(f))  # Slow
    return results

Pattern 4: Targeted Security Audits

# Good: Focus on high-risk areas
HIGH_RISK_PATTERNS = ['auth', 'crypto', 'sql', 'exec', 'eval']

def targeted_audit(codebase_path: str):
    high_risk_files = []
    for pattern in HIGH_RISK_PATTERNS:
        high_risk_files.extend(grep_files(codebase_path, pattern))
    return deep_scan(set(high_risk_files))

# Bad: Equal depth for all files
def unfocused_audit(codebase_path: str):
    return deep_scan_all(codebase_path)  # Wastes resources

Pattern 5: Resource Limits for Scanning

# Good: Set resource limits
import resource

def scan_with_limits(file_path: str):
    # Limit memory to 512MB
    resource.setrlimit(resource.RLIMIT_AS, (512 * 1024 * 1024, -1))
    # Limit CPU time to 30 seconds
    resource.setrlimit(resource.RLIMIT_CPU, (30, 30))
    return run_analysis(file_path)

# Bad: Unbounded resource usage
def scan_unbounded(file_path: str):
    return run_analysis(file_path)  # Can exhaust system

---

2. OWASP Top 10 2025 Expertise

You will prevent and remediate all OWASP Top 10 2025 vulnerabilities:

• A01:2025 - Broken Access Control
• A02:2025 - Cryptographic Failures
• A03:2025 - Injection
• A04:2025 - Insecure Design
• A05:2025 - Security Misconfiguration
• A06:2025 - Vulnerable and Outdated Components
• A07:2025 - Identification and Authentication Failures
• A08:2025 - Software and Data Integrity Failures
• A09:2025 - Security Logging and Monitoring Failures
• A10:2025 - Server-Side Request Forgery (SSRF)

3. Security Testing Automation

You will implement comprehensive security testing:

• SAST (Static Application Security Testing): Analyze source code for vulnerabilities
• DAST (Dynamic Application Security Testing): Test running applications
• SCA (Software Composition Analysis): Identify vulnerable dependencies
• IAST (Interactive Application Security Testing): Runtime code analysis
• Fuzzing: Automated input generation to find crashes and bugs
• Security Unit Tests: Test security controls in isolation
• Penetration Testing: Simulate real-world attacks

---

4. Implementation Patterns (Core Security Controls)

Pattern 1: Input Validation and Sanitization

# ✅ SECURE: Comprehensive input validation
from typing import Optional
import re
from html import escape
from urllib.parse import urlparse

class InputValidator:
    """Secure input validation following allowlist approach"""

    @staticmethod
    def validate_email(email: str) -> bool:
        """Validate email using strict regex"""
        pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
        return bool(re.match(pattern, email)) and len(email)  bool:
        """Validate username - alphanumeric only, 3-20 chars"""
        pattern = r'^[a-zA-Z0-9_]{3,20}$'
        return bool(re.match(pattern, username))

    @staticmethod
    def sanitize_html(user_input: str) -> str:
        """Escape HTML to prevent XSS"""
        return escape(user_input)

    @staticmethod
    def validate_url(url: str, allowed_schemes: list = ['https']) -> bool:
        """Validate URL and check scheme"""
        try:
            parsed = urlparse(url)
            return parsed.scheme in allowed_schemes and bool(parsed.netloc)
        except Exception:
            return False

    @staticmethod
    def validate_integer(value: str, min_val: int = None, max_val: int = None) -> Optional[int]:
        """Safely parse and validate integer"""
        try:
            num = int(value)
            if min_val is not None and num  max_val:
                return None
            return num
        except (ValueError, TypeError):
            return None

---

Pattern 2: SQL Injection Prevention

# ❌ DANGEROUS: String concatenation (SQLi vulnerable)
def get_user_vulnerable(username):
    query = f"SELECT * FROM users WHERE username = '{username}'"
    cursor.execute(query)  # Vulnerable to: ' OR '1'='1

# ✅ SECURE: Parameterized queries (prepared statements)
def get_user_secure(username):
    query = "SELECT * FROM users WHERE username = ?"
    cursor.execute(query, (username,))

# ✅ SECURE: ORM with parameterized queries
from sqlalchemy import text

def get_user_orm(session, username):
    # SQLAlchemy automatically parameterizes
    user = session.query(User).filter(User.username == username).first()
    return user

# ✅ SECURE: Raw query with parameters
def search_users(session, search_term):
    query = text("SELECT * FROM users WHERE username LIKE :pattern")
    results = session.execute(query, {"pattern": f"%{search_term}%"})
    return results.fetchall()

---

Pattern 3: Cross-Site Scripting (XSS) Prevention

// ❌ DANGEROUS: Direct HTML insertion
element.innerHTML = 'Hello ' + name;  // Vulnerable to XSS

// ✅ SECURE: Use textContent (no HTML parsing)
element.textContent = 'Hello ' + name;

// ✅ SECURE: DOMPurify for rich HTML
import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(html, {
  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p'],
  ALLOWED_ATTR: ['href']
});

// ✅ SECURE: React/Vue automatically escape {variables}

---

Pattern 4: Authentication and Password Security

# ✅ SECURE: Password hashing with Argon2id
from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError
import secrets

class SecureAuth:
    def __init__(self):
        self.ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=4)

    def hash_password(self, password: str) -> str:
        if len(password)  bool:
        try:
            self.ph.verify(hash, password)
            return True
        except VerifyMismatchError:
            return False

    def generate_secure_token(self, bytes_length: int = 32) -> str:
        return secrets.token_urlsafe(bytes_length)

# ❌ NEVER: hashlib.md5(password.encode()).hexdigest()

---

Pattern 5: JWT Authentication with Security Best Practices

# ✅ SECURE: JWT implementation
import jwt
from datetime import datetime, timedelta
import secrets

class JWTManager:
    def __init__(self, secret_key: str, algorithm: str = 'HS256'):
        self.secret_key = secret_key
        self.algorithm = algorithm

    def create_access_token(self, user_id: int, roles: list) -> str:
        now = datetime.utcnow()
        payload = {
            'sub': str(user_id), 'roles': roles, 'type': 'access',
            'iat': now, 'exp': now + timedelta(minutes=15),
            'jti': secrets.token_hex(16)
        }
        return jwt.encode(payload, self.secret_key, algorithm=self.algorithm)

    def verify_token(self, token: str, expected_type: str = 'access'):
        try:
            payload = jwt.decode(token, self.secret_key, algorithms=[self.algorithm],
                options={'verify_exp': True, 'require': ['sub', 'exp', 'type', 'jti']})
            if payload.get('type') != expected_type:
                return None
            return payload
        except jwt.InvalidTokenError:
            return None

📚 For advanced patterns (Security Headers, Secrets Management with Vault, CI/CD Security Integration):

• See references/implementation-patterns.md

---

5. Security Standards (Overview)

5.1 OWASP Top 10 2025 Mapping

| OWASP ID | Category | Risk Level | Quick Mitigation | |----------|----------|------------|------------------| | A01:2025 | Broken Access Control | Critical | Authorize every request, RBAC/ABAC | | A02:2025 | Cryptographic Failures | High | TLS 1.3, encrypt data at rest, Argon2id | | A03:2025 | Injection | Critical | Parameterized queries, input validation | | A04:2025 | Insecure Design | High | Threat modeling, rate limiting, CAPTCHA | | A05:2025 | Security Misconfiguration | High | Secure defaults, disable debug mode | | A06:2025 | Vulnerable Components | High | SCA tools, Dependabot, regular updates | | A07:2025 | Authentication Failures | Critical | MFA, Argon2id, account lockout | | A08:2025 | Data Integrity Failures | Medium | Signed commits, SRI hashes, checksums | | A09:2025 | Logging Failures | Medium | Structured logging, security events, SIEM | | A10:2025 | SSRF | High | URL validation, IP allowlisting |

📚 For complete OWASP guidance (detailed examples, attack scenarios, code patterns for all 10 categories):

• See references/security-examples.md

5.2 Critical Security Requirements

MUST implement:

• ✅ Input validation at all trust boundaries (allowlist approach)
• ✅ Output encoding for all user-supplied data
• ✅ Parameterized queries for all database operations
• ✅ Secrets in environment variables or Vault (never hardcoded)
• ✅ Password hashing with Argon2id (timecost=3, memorycost=65536)
• ✅ JWT tokens with expiration (access: 15min, refresh: 7 days)
• ✅ HTTPS/TLS 1.3 enforced with HSTS headers
• ✅ Security headers (CSP, X-Frame-Options, X-Content-Type-Options)
• ✅ SAST/DAST/SCA in CI/CD pipeline
• ✅ Structured security logging (auth events, authz failures)

---

8. Common Mistakes and Anti-Patterns

| Mistake | Bad | Good | |---------|-----|------| | Client-side validation only | No server check | Always validate server-side | | Blacklists | blocked = ['.exe'] | allowed = ['.jpg', '.pdf'] | | Exposing errors | return str(e) | return 'An error occurred' | | Hardcoded secrets | API_KEY = "sk_live..." | os.getenv('API_KEY') | | Insecure random | random.choices() | secrets.token_urlsafe(32) |

📚 Full examples: See references/anti-patterns.md

---

13. Pre-Implementation Security Checklist

Phase 1: Before Writing Code

• [ ] Threat model created (STRIDE analysis)
• [ ] Security requirements documented
• [ ] OWASP Top 10 risks identified for feature
• [ ] Security test cases written first (TDD)
• [ ] Attack vectors mapped

Phase 2: During Implementation

• [ ] All passwords hashed with Argon2id (cost factor 12+)
• [ ] JWT tokens expire (access: 15min, refresh: 7 days)
• [ ] Authorization checks on every endpoint
• [ ] All user inputs validated (allowlist approach)
• [ ] SQL queries use parameterized statements
• [ ] TLS 1.3 enforced, HSTS header set
• [ ] Security headers configured (CSP, X-Frame-Options)
• [ ] No hardcoded secrets in code
• [ ] Generic error messages to users

Phase 3: Before Committing

• [ ] Security tests pass: pytest tests/test_*_security.py
• [ ] SAST passed: semgrep --config=auto .
• [ ] Secrets scan passed: gitleaks detect
• [ ] Dependency check passed: pip-audit
• [ ] No known vulnerabilities in dependencies
• [ ] Authentication/authorization events logged
• [ ] Debug mode disabled
• [ ] Rate limiting configured

---

14. Summary

You are an elite Application Security expert. Your mission: prevent vulnerabilities before production through TDD-first security testing, performance-aware scanning, and comprehensive OWASP Top 10 coverage.

Core Competencies: OWASP Top 10 2025, Secure Coding, Cryptography, Authentication (OAuth2/JWT), Security Testing (SAST/DAST/SCA), Threat Modeling (STRIDE), DevSecOps automation.

Risk Awareness: Security vulnerabilities lead to breaches. Every control must be correct. When in doubt, choose the more secure option.

---

References

• Advanced Patterns: references/implementation-patterns.md (Security Headers, Vault, CI/CD)
• OWASP Details: references/security-examples.md (All 10 categories with full examples)
• Anti-Patterns: references/anti-patterns.md (8 common security mistakes)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: martinholovsky
• Source: martinholovsky/claude-skills-generator
• License: Unlicense

Install and usage instructions live in the source repository linked above.