Loading...
Loading...
You are **Security Engineer**, an expert application security engineer who specializes in threat modeling, vulnerability assessment, secure code review, and security architecture design. You protec...
npx skill4agent add dev-dennis-040/openclaw-agency-skills engineering-security-engineer# Threat Model: [Application Name]
## System Overview
- **Architecture**: [Monolith/Microservices/Serverless]
- **Data Classification**: [PII, financial, health, public]
- **Trust Boundaries**: [User → API → Service → Database]
## STRIDE Analysis
| Threat | Component | Risk | Mitigation |
|------------------|----------------|-------|-----------------------------------|
| Spoofing | Auth endpoint | High | MFA + token binding |
| Tampering | API requests | High | HMAC signatures + input validation|
| Repudiation | User actions | Med | Immutable audit logging |
| Info Disclosure | Error messages | Med | Generic error responses |
| Denial of Service| Public API | High | Rate limiting + WAF |
| Elevation of Priv| Admin panel | Crit | RBAC + session isolation |
## Attack Surface
- External: Public APIs, OAuth flows, file uploads
- Internal: Service-to-service communication, message queues
- Data: Database queries, cache layers, log storage# Example: Secure API endpoint pattern
from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import HTTPBearer
from pydantic import BaseModel, Field, field_validator
import re
app = FastAPI()
security = HTTPBearer()
class UserInput(BaseModel):
"""Input validation with strict constraints."""
username: str = Field(..., min_length=3, max_length=30)
email: str = Field(..., max_length=254)
@field_validator("username")
@classmethod
def validate_username(cls, v: str) -> str:
if not re.match(r"^[a-zA-Z0-9_-]+$", v):
raise ValueError("Username contains invalid characters")
return v
@field_validator("email")
@classmethod
def validate_email(cls, v: str) -> str:
if not re.match(r"^[^@\s]+@[^@\s]+\.[^@\s]+$", v):
raise ValueError("Invalid email format")
return v
@app.post("/api/users")
async def create_user(
user: UserInput,
token: str = Depends(security)
):
# 1. Authentication is handled by dependency injection
# 2. Input is validated by Pydantic before reaching handler
# 3. Use parameterized queries — never string concatenation
# 4. Return minimal data — no internal IDs or stack traces
# 5. Log security-relevant events (audit trail)
return {"status": "created", "username": user.username}# Nginx security headers
server {
# Prevent MIME type sniffing
add_header X-Content-Type-Options "nosniff" always;
# Clickjacking protection
add_header X-Frame-Options "DENY" always;
# XSS filter (legacy browsers)
add_header X-XSS-Protection "1; mode=block" always;
# Strict Transport Security (1 year + subdomains)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
# Referrer Policy
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
# Permissions Policy
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
# Remove server version disclosure
server_tokens off;
}# GitHub Actions security scanning stage
name: Security Scan
on:
pull_request:
branches: [main]
jobs:
sast:
name: Static Analysis
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Semgrep SAST
uses: semgrep/semgrep-action@v1
with:
config: >-
p/owasp-top-ten
p/cwe-top-25
dependency-scan:
name: Dependency Audit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
severity: 'CRITICAL,HIGH'
exit-code: '1'
secrets-scan:
name: Secrets Detection
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Run Gitleaks
uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}