Software Security & AppSec — Quick Reference Skill

Software Security & AppSec — Quick Reference

Production-grade security patterns for building secure applications in Jan 2026. Covers OWASP Top 10:2025 (stable) https://owasp.org/Top10/2025/ plus OWASP API Security Top 10 (2023) https://owasp.org/API-Security/ and secure SDLC baselines (NIST SSDF) https://csrc.nist.gov/publications/detail/sp/800-218/final.

When to Use This Skill

Activate this skill when:

Implementing authentication or authorization systems
Handling user input that could lead to injection attacks (SQL, XSS, command injection)
Designing secure APIs or web applications
Working with cryptographic operations or sensitive data storage
Conducting security reviews, threat modeling, or vulnerability assessments
Responding to security incidents or compliance audit requirements
Building systems that must comply with OWASP, NIST, PCI DSS, GDPR, HIPAA, or SOC 2
Integrating third-party dependencies (supply chain security review)
Implementing zero trust architecture or modern cloud-native security patterns
Establishing or improving secure SDLC gates (threat modeling, SAST/DAST, dependency scanning)

When NOT to Use This Skill

General backend development without security focus → use software-backend
Infrastructure/cloud security (IAM, network security, container hardening) → use ops-devops-platform
Smart contract auditing as primary focus → use software-crypto-web3
ML model security (adversarial attacks, data poisoning) → use ai-mlops
Compliance-only questions without implementation → consult compliance team directly

Quick Reference Table

| Security Task | Tool/Pattern | Implementation | When to Use | |---------------|--------------|----------------|-------------| | Primary Auth | Passkeys/WebAuthn | navigator.credentials.create() | New apps (2026+), phishing-resistant, broad platform support | | Password Storage | bcrypt/Argon2 | bcrypt.hash(password, 12) | Legacy auth fallback (never store plaintext) | | Input Validation | Allowlist regex | /^[a-zA-Z0-9_]{3,20}$/ | All user input (SQL, XSS, command injection prevention) | | SQL Queries | Parameterized queries | db.execute(query, [userId]) | All database operations (prevent SQL injection) | | API Authentication | OAuth 2.1 + PKCE | oauth.authorize({ code_challenge }) | Third-party auth, API access (deprecates implicit flow) | | Token Auth | JWT (short-lived) | jwt.sign(payload, secret, { expiresIn: '15m' }) | Stateless APIs (always validate, 15-30 min expiry) | | Data Encryption | AES-256-GCM | crypto.createCipheriv('aes-256-gcm') | Sensitive data at rest (PII, financial, health) | | HTTPS/TLS | TLS 1.3 | Force HTTPS redirects | All production traffic (data in transit) | | Access Control | RBAC/ABAC | requireRole('admin', 'moderator') | Resource authorization (APIs, admin panels) | | Rate Limiting | express-rate-limit | limiter({ windowMs: 15min, max: 100 }) | Public APIs, auth endpoints (DoS prevention) | | Security Requirements | OWASP ASVS | Choose L1/L2/L3 | Security requirements baseline + test scope |

Authentication Decision Matrix (Jan 2026)

| Method | Use Case | Token Lifetime | Security Level | Notes | |--------|----------|----------------|----------------|-------| | Passkeys/WebAuthn | Primary auth (2026+) | N/A (cryptographic) | Highest | Phishing-resistant, broad platform support | | OAuth 2.1 + PKCE | Third-party auth | 5-15 min access | High | Replaces implicit flow, mandatory PKCE | | Session cookies | Traditional web apps | 30 min - 4 hrs | Medium-High | HttpOnly, Secure, SameSite=Strict | | JWT stateless | APIs, microservices | 15-30 min | Medium | Always validate signature, short expiry | | API keys | Machine-to-machine | Long-lived | Low-Medium | Rotate regularly, scope permissions |

Jurisdiction notes (verify): Authentication assurance requirements vary by country, industry, and buyer. Prefer passkeys/FIDO2; treat SMS OTP as recovery-only/low assurance unless you can justify it.

OWASP Top 10:2025 Quick Checklist

| # | Risk | Key Controls | Test | |---|------|--------------|------| | A01 | Broken Access Control | RBAC/ABAC, deny by default, CORS allowlist | BOLA, BFLA, privilege escalation | | A02 | Security Misconfiguration | Harden defaults, disable unused features, error handling | Default creds, stack traces, headers | | A03 | Supply Chain Failures (NEW) | SBOM, dependency scanning, SLSA, code signing | Outdated deps, typosquatting, compromised packages | | A04 | Cryptographic Failures | TLS 1.3, AES-256-GCM, key rotation, no MD5/SHA1 | Weak ciphers, exposed secrets, cert validation | | A05 | Injection | Parameterized queries, input validation, output encoding | SQLi, XSS, command injection, LDAP injection | | A06 | Insecure Design | Threat modeling, secure design patterns, abuse cases | Design flaws, missing controls, trust boundaries | | A07 | Authentication Failures | MFA/passkeys, rate limiting, secure password storage | Credential stuffing, brute force, session fixation | | A08 | Integrity Failures | Code signing, CI/CD pipeline security, SRI | Unsigned updates, pipeline poisoning, CDN tampering | | A09 | Logging Failures | Structured JSON, SIEM integration, correlation IDs | Missing logs, PII in logs, no alerting | | A10 | Exceptional Conditions (NEW) | Fail-safe defaults, complete error recovery, input validation | Error handling gaps, fail-open, resource exhaustion |

Decision Tree: Security Implementation

Security requirement: [Feature Type]
    ├─ User Authentication?
    │   ├─ Session-based? → Cookie sessions + CSRF tokens
    │   ├─ Token-based? → JWT with refresh tokens (references/authentication-authorization.md)
    │   └─ Third-party? → OAuth2/OIDC integration
    │
    ├─ User Input?
    │   ├─ Database query? → Parameterized queries (NEVER string concatenation)
    │   ├─ HTML output? → DOMPurify sanitization + CSP headers
    │   ├─ File upload? → Content validation, size limits, virus scanning
    │   └─ API parameters? → Allowlist validation (references/input-validation.md)
    │
    ├─ Sensitive Data?
    │   ├─ Passwords? → bcrypt/Argon2 (cost factor 12+)
    │   ├─ PII/financial? → AES-256-GCM encryption + key rotation
    │   ├─ API keys/tokens? → Environment variables + secrets manager
    │   └─ In transit? → TLS 1.3 only
    │
    ├─ Access Control?
    │   ├─ Simple roles? → RBAC (assets/web-application/template-authorization.md)
    │   ├─ Complex rules? → ABAC with policy engine
    │   └─ Relationship-based? → ReBAC (owner, collaborator, viewer)
    │
    └─ API Security?
        ├─ Public API? → Rate limiting + API keys
        ├─ CORS needed? → Strict origin allowlist (never *)
        └─ Headers? → Helmet.js (CSP, HSTS, X-Frame-Options)

Security ROI & Business Value (Jan 2026)

Security investment justification and compliance-driven revenue. Full framework: references/security-business-value.md

Quick Breach Cost Reference

Indicative figures (source: IBM Cost of a Data Breach 2024; refresh for current year): https://www.ibm.com/reports/data-breach

| Metric | Global Avg | US Avg | Impact | |--------|------------|--------|--------| | Avg breach cost | $4.88M | $9.36M | Budget justification baseline | | Cost per record | $165 | $194 | Data classification priority | | Detection time | 204 days | 191 days | SIEM/monitoring ROI | | DevSecOps adoption | -$1.68M | -34% | Shift-left justification | | IR team | -$2.26M | -46% | Highest ROI control |

Compliance → Enterprise Sales

| Certification | Deals Unlocked | Sales Impact | |---------------|----------------|--------------| | SOC 2 Type II | $100K+ enterprise | Typically reduces security questionnaire friction | | ISO 27001 | $250K+ EU enterprise | Preferred vendor status | | HIPAA | Healthcare vertical | Market access | | FedRAMP | $1M+ government | US gov market entry |

ROI Formula (Quick Reference)

Security ROI = (Risk Reduction - Investment) / Investment × 100

Risk Reduction = Breach Probability × Avg Cost × Control Effectiveness
Example: 15% × $4.88M × 46% = $337K/year risk reduction

Incident Response Patterns (Jan 2026)

Security Incident Playbook

| Phase | Actions | |-------|---------| | Detect | Alert fires, user report, automated scan | | Contain | Isolate affected systems, revoke compromised credentials | | Investigate | Collect logs, determine scope, identify root cause | | Remediate | Patch vulnerability, rotate secrets, update defenses | | Recover | Restore services, verify fixes, update monitoring | | Learn | Post-mortem, update playbooks, share lessons |

Security Logging Requirements

| What to Log | Format | Retention | |-------------|--------|-----------| | Authentication events | JSON with correlation ID | 90 days minimum | | Authorization failures | JSON with user context | 90 days minimum | | Data access (sensitive) | JSON with resource ID | 1 year minimum | | Security scan results | SARIF format | 1 year minimum |

Do:

Include correlation IDs across services
Log to SIEM (Splunk, Datadog, ELK)
Mask PII in logs

Avoid:

Logging passwords, tokens, or keys
Unstructured log formats
Missing timestamps or context

Common Security Mistakes

| FAIL Bad Practice | PASS Correct Approach | Risk | | --------------- | ------------------- | ---- | | query = "SELECT * FROM users WHERE id=" + userId | db.execute("SELECT * FROM users WHERE id=?", [userId]) | SQL injection | | Storing passwords in plaintext or MD5 | bcrypt.hash(password, 12) or Argon2 | Credential theft | | res.send(userInput) without encoding | res.send(DOMPurify.sanitize(userInput)) | XSS | | Hardcoded API keys in source code | Environment variables + secrets manager | Secret exposure | | Access-Control-Allow-Origin: * | Explicit origin allowlist | CORS bypass | | JWT with no expiration | expiresIn: '15m' + refresh tokens | Token hijacking | | Generic error messages to logs | Structured JSON with correlation IDs | Debugging blind spots | | SMS OTP as primary factor | Passkeys/WebAuthn or TOTP (keep SMS for recovery-only) | Credential phishing |

Optional: AI/Automation Extensions

Note: Security considerations for AI systems. Skip if not building AI features.

LLM Security Patterns

| Threat | Mitigation | |--------|------------| | Prompt injection | Input validation, output filtering, sandboxed execution | | Data exfiltration | Output scanning, PII detection | | Model theft | API rate limiting, watermarking | | Jailbreaking | Constitutional AI, guardrails |

AI-Assisted Security Tools

| Tool | Use Case | |------|----------| | Semgrep | Static analysis with AI rules | | Snyk Code | AI-powered vulnerability detection | | GitHub CodeQL | Semantic code analysis |

.NET/EF Core Crypto Integration Security

For C#/.NET crypto/fintech services using Entity Framework Core, see:

references/dotnet-efcore-crypto-security.md — Security rules and C# patterns

Key rules summary:

No secrets in code — use configuration/environment variables
No sensitive data in logs (tokens, keys, PII)
Use decimal for financial values, never double/float
EF Core or parameterized queries only — no dynamic SQL
Generic error messages to users, detailed logging server-side

Navigation

Core Resources (Updated 2024-2026)

Security Business Value & ROI

references/security-business-value.md — Breach cost modeling, security ROI formulas, compliance → enterprise sales, investment justification templates

2025 Updates & Modern Architecture

references/supply-chain-security.md — Dependency, build, and artifact integrity (SLSA, provenance, signing)
references/zero-trust-architecture.md — NIST SP 800-207, service identity, policy-based access
references/owasp-top-10.md — OWASP Top 10:2025 (final) guide + 2021→2025 diffs
references/advanced-xss-techniques.md — 2024-2025 XSS: mutation XSS, polyglots, SVG attacks, context-aware encoding

API Security, Incident Response & Threat Modeling

references/api-security-patterns.md — OWASP API Security Top 10, BOLA/BFLA, rate limiting, API keys, GraphQL/gRPC security
references/incident-response-playbook.md — IR team roles, severity triage, containment by incident type, evidence handling, communication templates, postmortem
references/threat-modeling-guide.md — STRIDE, PASTA, data flow diagrams, attack trees, risk scoring (CVSS/DREAD), lightweight agile threat modeling

Foundation Security Patterns

references/secure-design-principles.md — Defense in depth, least privilege, secure defaults
references/authentication-authorization.md — AuthN/AuthZ flows, OAuth 2.1, JWT best practices, RBAC/ABAC
references/input-validation.md — Allowlist validation, SQL injection, XSS, CSRF prevention, file upload security
references/cryptography-standards.md — AES-256-GCM, Argon2, TLS 1.3, key management
references/common-vulnerabilities.md — Path traversal, command injection, deserialization, SSRF

External References

data/sources.json — 70+ curated security resources (OWASP 2025, supply chain, zero trust, API security, compliance)
Shared checklists: ../software-clean-code-standard/assets/checklists/secure-code-review-checklist.md, ../software-clean-code-standard/assets/checklists/backend-api-review-checklist.md

Templates by Domain

Web Application Security

assets/web-application/template-authentication.md — Secure authentication flows (JWT, OAuth2, sessions, MFA)
assets/web-application/template-authorization.md — RBAC/ABAC/ReBAC policy patterns

API Security

assets/api/template-secure-api.md — Secure API gateway, rate limiting, CORS, security headers

Cloud-Native Security

assets/cloud-native/crypto-security.md — Cryptography usage, key management, HSM integration

Blockchain & Web3 Security

references/smart-contract-security-auditing.md — NEW: Smart contract auditing, vulnerability patterns, formal verification, Solidity security

Related Skills

Security Ecosystem

../software-backend/SKILL.md — API implementation patterns and error handling
../software-architecture-design/SKILL.md — Secure system decomposition and dependency design
../ops-devops-platform/SKILL.md — DevSecOps pipelines, secrets management, infrastructure hardening
../software-crypto-web3/SKILL.md — Smart contract security, blockchain vulnerabilities, DeFi patterns
../qa-testing-strategy/SKILL.md — Security testing, SAST/DAST integration, penetration testing

AI/LLM Security

../ai-llm/SKILL.md — LLM security patterns including prompt injection prevention
../ai-mlops/SKILL.md — ML model security, adversarial attacks, privacy-preserving ML

Quality & Resilience

../qa-resilience/SKILL.md — Resilience, safeguards, failure handling, chaos engineering
../qa-refactoring/SKILL.md — Security-focused refactoring patterns

Trend Awareness Protocol

IMPORTANT: When users ask recommendation questions about application security, you MUST use WebSearch to check current trends before answering. If WebSearch is unavailable, use data/sources.json + web browsing and state what you verified vs assumed.

Trigger Conditions

"What's the best approach for [authentication/authorization]?"
"What should I use for [secrets/encryption/API security]?"
"What's the latest in application security?"
"Current best practices for [OWASP/zero trust/supply chain]?"
"Is [security approach] still recommended in 2026?"
"What are the latest security vulnerabilities?"
"Best auth solution for [use case]?"

Required Searches

Search: "application security best practices 2026"
Search: "OWASP Top 10 2025 2026"
Search: "[authentication/authorization] trends 2026"
Search: "supply chain security 2026"

What to Report

After searching, provide:

Current landscape: What security approaches are standard NOW
Emerging threats: New vulnerabilities or attack vectors
Deprecated/declining: Approaches that are no longer secure
Recommendation: Based on fresh data and current advisories

Example Topics (verify with fresh search)

OWASP Top 10 updates
Passkeys and passwordless authentication
AI security concerns (prompt injection, model poisoning)
Supply chain security (SBOMs, dependency scanning)
Zero trust architecture implementation
API security (BOLA, broken auth)

Pre-Implementation Security Gate

Before building any feature that involves storage, uploads, or user-generated content:

Threat model first: Identify what an attacker could do with this feature (file upload → malware, storage → data exfiltration, user content → XSS).
Check OWASP mapping: Map the feature to relevant OWASP Top 10 categories above.
Define constraints before coding: Set file type allowlist, size limits, storage isolation, and access controls before writing the first line.
Review existing security patterns: Check if the project already has upload/storage security utilities to reuse.

Building storage/upload features without upfront security constraints leads to retroactive hardening that is more expensive and error-prone.

Operational Playbooks

references/operational-playbook.md — Core security principles, OWASP summaries, authentication patterns, and detailed code examples

Fact-Checking

Use web search/web fetch to verify current external facts, versions, pricing, deadlines, regulations, or platform behavior before final answers.
Prefer primary sources; report source links and dates for volatile information.
If web access is unavailable, state the limitation and mark guidance as unverified.

Agent Skills: Software Security & AppSec — Quick Reference

Install this agent skill to your local

Skill Files