Back to Details

software-security-appsec

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Software Security & AppSec — Quick Reference

软件安全与应用安全（AppSec）——快速参考

Production-grade security patterns for building secure applications in Jan 2026. Covers OWASP Top 10:2025 (stable) https://owasp.org/Top10/2025/ plus OWASP API Security Top 10 (2023) https://owasp.org/API-Security/ and secure SDLC baselines (NIST SSDF) https://csrc.nist.gov/publications/detail/sp/800-218/final.
2026年1月适用的生产级安全应用构建安全模式。涵盖OWASP Top 10:2025（稳定版）https://owasp.org/Top10/2025/、OWASP API安全Top 10（2023）https://owasp.org/API-Security/以及安全开发生命周期（SDLC）基线（NIST SSDF）https://csrc.nist.gov/publications/detail/sp/800-218/final。

When to Use This Skill

何时使用该技能

Activate this skill when:
  • Implementing authentication or authorization systems
  • Handling user input that could lead to injection attacks (SQL, XSS, command injection)
  • Designing secure APIs or web applications
  • Working with cryptographic operations or sensitive data storage
  • Conducting security reviews, threat modeling, or vulnerability assessments
  • Responding to security incidents or compliance audit requirements
  • Building systems that must comply with OWASP, NIST, PCI DSS, GDPR, HIPAA, or SOC 2
  • Integrating third-party dependencies (supply chain security review)
  • Implementing zero trust architecture or modern cloud-native security patterns
  • Establishing or improving secure SDLC gates (threat modeling, SAST/DAST, dependency scanning)
在以下场景激活该技能：
  • 实施身份验证或授权系统
  • 处理可能引发注入攻击（SQL、XSS、命令注入）的用户输入
  • 设计安全API或Web应用
  • 处理加密操作或敏感数据存储
  • 开展安全审查、威胁建模或漏洞评估
  • 响应安全事件或合规审计要求
  • 构建必须符合OWASP、NIST、PCI DSS、GDPR、HIPAA或SOC 2标准的系统
  • 集成第三方依赖（供应链安全审查）
  • 实施零信任架构或现代云原生安全模式
  • 建立或改进安全SDLC关卡（威胁建模、SAST/DAST、依赖扫描）

When NOT to Use This Skill

何时不使用该技能

  • General backend development without security focus → use software-backend
  • Infrastructure/cloud security (IAM, network security, container hardening) → use ops-devops-platform
  • Smart contract auditing as primary focus → use software-crypto-web3
  • ML model security (adversarial attacks, data poisoning) → use ai-mlops
  • Compliance-only questions without implementation → consult compliance team directly
  • 无安全聚焦的通用后端开发 → 使用software-backend
  • 基础设施/云安全（IAM、网络安全、容器加固）→ 使用ops-devops-platform
  • 以智能合约审计为核心 → 使用software-crypto-web3
  • ML模型安全（对抗性攻击、数据投毒）→ 使用ai-mlops
  • 仅合规问题无落地需求 → 直接咨询合规团队

Quick Reference Table

快速参考表格

Security TaskTool/PatternImplementationWhen to Use
Primary AuthPasskeys/WebAuthn
navigator.credentials.create()
New apps (2026+), phishing-resistant, broad platform support
Password Storagebcrypt/Argon2
bcrypt.hash(password, 12)
Legacy auth fallback (never store plaintext)
Input ValidationAllowlist regex
/^[a-zA-Z0-9_]{3,20}$/
All user input (SQL, XSS, command injection prevention)
SQL QueriesParameterized queries
db.execute(query, [userId])
All database operations (prevent SQL injection)
API AuthenticationOAuth 2.1 + PKCE
oauth.authorize({ code_challenge })
Third-party auth, API access (deprecates implicit flow)
Token AuthJWT (short-lived)
jwt.sign(payload, secret, { expiresIn: '15m' })
Stateless APIs (always validate, 15-30 min expiry)
Data EncryptionAES-256-GCM
crypto.createCipheriv('aes-256-gcm')
Sensitive data at rest (PII, financial, health)
HTTPS/TLSTLS 1.3Force HTTPS redirectsAll production traffic (data in transit)
Access ControlRBAC/ABAC
requireRole('admin', 'moderator')
Resource authorization (APIs, admin panels)
Rate Limitingexpress-rate-limit
limiter({ windowMs: 15min, max: 100 })
Public APIs, auth endpoints (DoS prevention)
Security RequirementsOWASP ASVSChoose L1/L2/L3Security requirements baseline + test scope
安全任务工具/模式实现方式使用场景
主身份验证Passkeys/WebAuthn
navigator.credentials.create()
新应用（2026+）、抗钓鱼、多平台支持
密码存储bcrypt/Argon2
bcrypt.hash(password, 12)
遗留身份验证降级方案（绝不要存储明文）
输入验证白名单正则
/^[a-zA-Z0-9_]{3,20}$/
所有用户输入（预防SQL、XSS、命令注入）
SQL查询参数化查询
db.execute(query, [userId])
所有数据库操作（预防SQL注入）
API身份验证OAuth 2.1 + PKCE
oauth.authorize({ code_challenge })
第三方身份验证、API访问（淘汰隐式流）
令牌身份验证JWT（短有效期）
jwt.sign(payload, secret, { expiresIn: '15m' })
无状态API（始终验证，有效期15-30分钟）
数据加密AES-256-GCM
crypto.createCipheriv('aes-256-gcm')
静态敏感数据（PII、财务、健康数据）
HTTPS/TLSTLS 1.3强制HTTPS重定向所有生产流量（传输中数据）
访问控制RBAC/ABAC
requireRole('admin', 'moderator')
资源授权（API、管理面板）
速率限制express-rate-limit
limiter({ windowMs: 15min, max: 100 })
公共API、身份验证端点（预防DoS）
安全要求OWASP ASVS选择L1/L2/L3安全要求基线+测试范围

Authentication Decision Matrix (Jan 2026)

身份验证决策矩阵（2026年1月）

MethodUse CaseToken LifetimeSecurity LevelNotes
Passkeys/WebAuthnPrimary auth (2026+)N/A (cryptographic)HighestPhishing-resistant, broad platform support
OAuth 2.1 + PKCEThird-party auth5-15 min accessHighReplaces implicit flow, mandatory PKCE
Session cookiesTraditional web apps30 min - 4 hrsMedium-HighHttpOnly, Secure, SameSite=Strict
JWT statelessAPIs, microservices15-30 minMediumAlways validate signature, short expiry
API keysMachine-to-machineLong-livedLow-MediumRotate regularly, scope permissions
Jurisdiction notes (verify): Authentication assurance requirements vary by country, industry, and buyer. Prefer passkeys/FIDO2; treat SMS OTP as recovery-only/low assurance unless you can justify it.
方法使用场景令牌有效期安全级别说明
Passkeys/WebAuthn主身份验证（2026+）N/A（加密型）最高抗钓鱼、多平台支持
OAuth 2.1 + PKCE第三方身份验证5-15分钟访问令牌高替代隐式流，强制使用PKCE
会话Cookie传统Web应用30分钟-4小时中高HttpOnly、Secure、SameSite=Strict
无状态JWTAPI、微服务15-30分钟中始终验证签名，短有效期
API密钥机器对机器通信长期有效中低定期轮换，权限范围化
司法管辖区注意事项（需验证）：身份验证保障要求因国家、行业和客户而异。优先选择Passkeys/FIDO2；除非有充分理由，否则仅将SMS OTP用作恢复手段或低保障方案。

OWASP Top 10:2025 Quick Checklist

OWASP Top 10:2025快速检查清单

#RiskKey ControlsTest
A01Broken Access ControlRBAC/ABAC, deny by default, CORS allowlistBOLA, BFLA, privilege escalation
A02Security MisconfigurationHarden defaults, disable unused features, error handlingDefault creds, stack traces, headers
A03Supply Chain Failures (NEW)SBOM, dependency scanning, SLSA, code signingOutdated deps, typosquatting, compromised packages
A04Cryptographic FailuresTLS 1.3, AES-256-GCM, key rotation, no MD5/SHA1Weak ciphers, exposed secrets, cert validation
A05InjectionParameterized queries, input validation, output encodingSQLi, XSS, command injection, LDAP injection
A06Insecure DesignThreat modeling, secure design patterns, abuse casesDesign flaws, missing controls, trust boundaries
A07Authentication FailuresMFA/passkeys, rate limiting, secure password storageCredential stuffing, brute force, session fixation
A08Integrity FailuresCode signing, CI/CD pipeline security, SRIUnsigned updates, pipeline poisoning, CDN tampering
A09Logging FailuresStructured JSON, SIEM integration, correlation IDsMissing logs, PII in logs, no alerting
A10Exceptional Conditions (NEW)Fail-safe defaults, complete error recovery, input validationError handling gaps, fail-open, resource exhaustion
#风险关键控制措施测试项
A01访问控制失效RBAC/ABAC、默认拒绝、CORS白名单BOLA、BFLA、权限提升
A02安全配置错误加固默认设置、禁用未使用功能、错误处理默认凭据、堆栈跟踪、响应头
A03供应链故障（新增）SBOM、依赖扫描、SLSA、代码签名过时依赖、打字 squatting、受 compromise 包
A04加密失效TLS 1.3、AES-256-GCM、密钥轮换、禁用MD5/SHA1弱密码套件、暴露的密钥、证书验证
A05注入攻击参数化查询、输入验证、输出编码SQL注入、XSS、命令注入、LDAP注入
A06不安全设计威胁建模、安全设计模式、滥用场景设计缺陷、缺失控制措施、信任边界
A07身份验证失效MFA/Passkeys、速率限制、安全密码存储凭证填充、暴力破解、会话固定
A08完整性失效代码签名、CI/CD流水线安全、SRI未签名更新、流水线投毒、CDN篡改
A09日志记录失效结构化JSON、SIEM集成、关联ID缺失日志、日志中包含PII、无告警
A10异常情况处理失效（新增）故障安全默认设置、完整错误恢复、输入验证错误处理漏洞、故障开放、资源耗尽

Decision Tree: Security Implementation

安全实现决策树

text
Security requirement: [Feature Type]
    ├─ User Authentication?
    │   ├─ Session-based? → Cookie sessions + CSRF tokens
    │   ├─ Token-based? → JWT with refresh tokens (references/authentication-authorization.md)
    │   └─ Third-party? → OAuth2/OIDC integration
    │
    ├─ User Input?
    │   ├─ Database query? → Parameterized queries (NEVER string concatenation)
    │   ├─ HTML output? → DOMPurify sanitization + CSP headers
    │   ├─ File upload? → Content validation, size limits, virus scanning
    │   └─ API parameters? → Allowlist validation (references/input-validation.md)
    │
    ├─ Sensitive Data?
    │   ├─ Passwords? → bcrypt/Argon2 (cost factor 12+)
    │   ├─ PII/financial? → AES-256-GCM encryption + key rotation
    │   ├─ API keys/tokens? → Environment variables + secrets manager
    │   └─ In transit? → TLS 1.3 only
    │
    ├─ Access Control?
    │   ├─ Simple roles? → RBAC (assets/web-application/template-authorization.md)
    │   ├─ Complex rules? → ABAC with policy engine
    │   └─ Relationship-based? → ReBAC (owner, collaborator, viewer)
    │
    └─ API Security?
        ├─ Public API? → Rate limiting + API keys
        ├─ CORS needed? → Strict origin allowlist (never *)
        └─ Headers? → Helmet.js (CSP, HSTS, X-Frame-Options)
text
安全需求: [功能类型]
    ├─ 用户身份验证?
    │   ├─ 基于会话? → Cookie会话 + CSRF令牌
    │   ├─ 基于令牌? → 带刷新令牌的JWT（参考/authentication-authorization.md）
    │   └─ 第三方? → OAuth2/OIDC集成
    │
    ├─ 用户输入?
    │   ├─ 数据库查询? → 参数化查询（绝不要字符串拼接）
    │   ├─ HTML输出? → DOMPurify清理 + CSP响应头
    │   ├─ 文件上传? → 内容验证、大小限制、病毒扫描
    │   └─ API参数? → 白名单验证（参考/input-validation.md）
    │
    ├─ 敏感数据?
    │   ├─ 密码? → bcrypt/Argon2（成本因子12+）
    │   ├─ PII/财务数据? → AES-256-GCM加密 + 密钥轮换
    │   ├─ API密钥/令牌? → 环境变量 + 密钥管理器
    │   └─ 传输中数据? → 仅使用TLS 1.3
    │
    ├─ 访问控制?
    │   ├─ 简单角色? → RBAC（assets/web-application/template-authorization.md）
    │   ├─ 复杂规则? → 带策略引擎的ABAC
    │   └─ 基于关系? → ReBAC（所有者、协作者、查看者）
    │
    └─ API安全?
        ├─ 公共API? → 速率限制 + API密钥
        ├─ 需要CORS? → 严格的源白名单（绝不要用*）
        └─ 响应头? → Helmet.js（CSP、HSTS、X-Frame-Options）

Security ROI & Business Value (Jan 2026)

安全ROI与业务价值（2026年1月）

Security investment justification and compliance-driven revenue. Full framework: references/security-business-value.md
安全投资合理性论证与合规驱动的营收。完整框架：references/security-business-value.md

Quick Breach Cost Reference

数据泄露成本快速参考

Indicative figures (source: IBM Cost of a Data Breach 2024; refresh for current year): https://www.ibm.com/reports/data-breach
MetricGlobal AvgUS AvgImpact
Avg breach cost$4.88M$9.36MBudget justification baseline
Cost per record$165$194Data classification priority
Detection time204 days191 daysSIEM/monitoring ROI
DevSecOps adoption-$1.68M-34%Shift-left justification
IR team-$2.26M-46%Highest ROI control
指示性数据（来源：IBM 2024年数据泄露成本报告；每年更新）：https://www.ibm.com/reports/data-breach
指标全球平均美国平均影响
平均泄露成本488万美元936万美元预算合理性基线
单条记录成本165美元194美元数据分类优先级
检测时间204天191天SIEM/监控ROI
DevSecOps采用减少168万美元降低34%左移安全合理性论证
事件响应团队减少226万美元降低46%ROI最高的控制措施

Compliance → Enterprise Sales

合规→企业销售

CertificationDeals UnlockedSales Impact
SOC 2 Type II$100K+ enterpriseTypically reduces security questionnaire friction
ISO 27001$250K+ EU enterprisePreferred vendor status
HIPAAHealthcare verticalMarket access
FedRAMP$1M+ governmentUS gov market entry
认证解锁的交易规模销售影响
SOC 2 Type II10万美元以上的企业单通常减少安全问卷沟通成本
ISO 2700125万美元以上的欧盟企业单优先供应商资格
HIPAA医疗垂直领域市场准入
FedRAMP100万美元以上的政府单美国政府市场准入

ROI Formula (Quick Reference)

ROI公式（快速参考）

text
Security ROI = (Risk Reduction - Investment) / Investment × 100

Risk Reduction = Breach Probability × Avg Cost × Control Effectiveness
Example: 15% × $4.88M × 46% = $337K/year risk reduction
text
安全ROI = (风险降低额 - 投资额) / 投资额 × 100

风险降低额 = 泄露概率 × 平均成本 × 控制措施有效性
示例：15% × 488万美元 × 46% = 每年减少33.7万美元风险

Incident Response Patterns (Jan 2026)

事件响应模式（2026年1月）

Security Incident Playbook

安全事件手册

PhaseActions
DetectAlert fires, user report, automated scan
ContainIsolate affected systems, revoke compromised credentials
InvestigateCollect logs, determine scope, identify root cause
RemediatePatch vulnerability, rotate secrets, update defenses
RecoverRestore services, verify fixes, update monitoring
LearnPost-mortem, update playbooks, share lessons
阶段行动
检测告警触发、用户报告、自动化扫描
遏制隔离受影响系统、吊销泄露凭据
调查收集日志、确定范围、识别根本原因
修复修补漏洞、轮换密钥、更新防御措施
恢复恢复服务、验证修复、更新监控
复盘事后分析、更新手册、分享经验

Security Logging Requirements

安全日志记录要求

What to LogFormatRetention
Authentication eventsJSON with correlation ID90 days minimum
Authorization failuresJSON with user context90 days minimum
Data access (sensitive)JSON with resource ID1 year minimum
Security scan resultsSARIF format1 year minimum
Do:
  • Include correlation IDs across services
  • Log to SIEM (Splunk, Datadog, ELK)
  • Mask PII in logs
Avoid:
  • Logging passwords, tokens, or keys
  • Unstructured log formats
  • Missing timestamps or context
记录内容格式保留期限
身份验证事件带关联ID的JSON至少90天
授权失败事件带用户上下文的JSON至少90天
敏感数据访问带资源ID的JSON至少1年
安全扫描结果SARIF格式至少1年
需执行：
  • 在各服务中包含关联ID
  • 日志发送至SIEM（Splunk、Datadog、ELK）
  • 日志中屏蔽PII
需避免：
  • 记录密码、令牌或密钥
  • 非结构化日志格式
  • 缺失时间戳或上下文

Common Security Mistakes

常见安全错误

FAIL Bad PracticePASS Correct ApproachRisk
query = "SELECT * FROM users WHERE id=" + userId
db.execute("SELECT * FROM users WHERE id=?", [userId])
SQL injection
Storing passwords in plaintext or MD5
bcrypt.hash(password, 12)
or Argon2		Credential theft
res.send(userInput)
without encoding
res.send(DOMPurify.sanitize(userInput))
XSS
Hardcoded API keys in source codeEnvironment variables + secrets managerSecret exposure
Access-Control-Allow-Origin: *
Explicit origin allowlistCORS bypass
JWT with no expiration
expiresIn: '15m'
+ refresh tokens		Token hijacking
Generic error messages to logsStructured JSON with correlation IDsDebugging blind spots
SMS OTP as primary factorPasskeys/WebAuthn or TOTP (keep SMS for recovery-only)Credential phishing
错误做法正确做法风险
query = "SELECT * FROM users WHERE id=" + userId
db.execute("SELECT * FROM users WHERE id=?", [userId])
SQL注入
明文或MD5存储密码
bcrypt.hash(password, 12)
或 Argon2		凭证被盗
res.send(userInput)
未编码
res.send(DOMPurify.sanitize(userInput))
XSS
源代码中硬编码API密钥环境变量 + 密钥管理器密钥泄露
Access-Control-Allow-Origin: *
显式源白名单CORS绕过
JWT无过期时间
expiresIn: '15m'
+ 刷新令牌		令牌劫持
日志中使用通用错误信息带关联ID的结构化JSON调试盲区
SMS OTP作为主验证因子Passkeys/WebAuthn 或 TOTP（仅将SMS用作恢复）凭证钓鱼

Optional: AI/Automation Extensions

可选：AI/自动化扩展

Note: Security considerations for AI systems. Skip if not building AI features.
注意：AI系统的安全注意事项。若未构建AI功能可跳过。

LLM Security Patterns

LLM安全模式

ThreatMitigation
Prompt injectionInput validation, output filtering, sandboxed execution
Data exfiltrationOutput scanning, PII detection
Model theftAPI rate limiting, watermarking
JailbreakingConstitutional AI, guardrails
威胁缓解措施
提示注入输入验证、输出过滤、沙箱执行
数据泄露输出扫描、PII检测
模型被盗API速率限制、水印
越狱Constitutional AI、防护机制

AI-Assisted Security Tools

AI辅助安全工具

ToolUse Case
SemgrepStatic analysis with AI rules
Snyk CodeAI-powered vulnerability detection
GitHub CodeQLSemantic code analysis
工具使用场景
Semgrep带AI规则的静态分析
Snyk CodeAI驱动的漏洞检测
GitHub CodeQL语义代码分析

.NET/EF Core Crypto Integration Security

.NET/EF Core加密集成安全

For C#/.NET crypto/fintech services using Entity Framework Core, see:
  • references/dotnet-efcore-crypto-security.md — Security rules and C# patterns
Key rules summary:
  • No secrets in code — use configuration/environment variables
  • No sensitive data in logs (tokens, keys, PII)
  • Use 
    decimal
    for financial values, never 
    double
    /
    float
  • EF Core or parameterized queries only — no dynamic SQL
  • Generic error messages to users, detailed logging server-side
针对使用Entity Framework Core的C#/.NET加密/金融科技服务，请参考：
  • references/dotnet-efcore-crypto-security.md — 安全规则与C#模式
关键规则摘要：
  • 代码中不得包含密钥 — 使用配置/环境变量
  • 日志中不得包含敏感数据（令牌、密钥、PII）
  • 财务值使用
    decimal
    ，绝不要用
    double
    /
    float
  • 仅使用EF Core或参数化查询 — 禁止动态SQL
  • 向用户返回通用错误信息，服务器端记录详细日志

Navigation

导航

Core Resources (Updated 2024-2026)

核心资源（2024-2026更新）

Security Business Value & ROI

安全业务价值与ROI

  • references/security-business-value.md — Breach cost modeling, security ROI formulas, compliance → enterprise sales, investment justification templates
  • references/security-business-value.md — 数据泄露成本建模、安全ROI公式、合规→企业销售、投资合理性论证模板

2025 Updates & Modern Architecture

2025更新与现代架构

  • references/supply-chain-security.md — Dependency, build, and artifact integrity (SLSA, provenance, signing)
  • references/zero-trust-architecture.md — NIST SP 800-207, service identity, policy-based access
  • references/owasp-top-10.md — OWASP Top 10:2025 (final) guide + 2021→2025 diffs
  • references/advanced-xss-techniques.md — 2024-2025 XSS: mutation XSS, polyglots, SVG attacks, context-aware encoding
  • references/supply-chain-security.md — 依赖项、构建与制品完整性（SLSA、溯源、签名）
  • references/zero-trust-architecture.md — NIST SP 800-207、服务身份、基于策略的访问
  • references/owasp-top-10.md — OWASP Top 10:2025（最终版）指南 + 2021→2025差异
  • references/advanced-xss-techniques.md — 2024-2025 XSS：变异XSS、多语言脚本、SVG攻击、上下文感知编码

Foundation Security Patterns

基础安全模式

  • references/secure-design-principles.md — Defense in depth, least privilege, secure defaults
  • references/authentication-authorization.md — AuthN/AuthZ flows, OAuth 2.1, JWT best practices, RBAC/ABAC
  • references/input-validation.md — Allowlist validation, SQL injection, XSS, CSRF prevention, file upload security
  • references/cryptography-standards.md — AES-256-GCM, Argon2, TLS 1.3, key management
  • references/common-vulnerabilities.md — Path traversal, command injection, deserialization, SSRF
  • references/secure-design-principles.md — 纵深防御、最小权限、安全默认设置
  • references/authentication-authorization.md — 身份验证/授权流程、OAuth 2.1、JWT最佳实践、RBAC/ABAC
  • references/input-validation.md — 白名单验证、SQL注入、XSS、CSRF预防、文件上传安全
  • references/cryptography-standards.md — AES-256-GCM、Argon2、TLS 1.3、密钥管理
  • references/common-vulnerabilities.md — 路径遍历、命令注入、反序列化、SSRF

External References

外部参考

  • data/sources.json — 70+ curated security resources (OWASP 2025, supply chain, zero trust, API security, compliance)
  • Shared checklists: ../software-clean-code-standard/assets/checklists/secure-code-review-checklist.md, ../software-clean-code-standard/assets/checklists/backend-api-review-checklist.md
  • data/sources.json — 70+精选安全资源（OWASP 2025、供应链、零信任、API安全、合规）
  • 共享检查清单：../software-clean-code-standard/assets/checklists/secure-code-review-checklist.md、../software-clean-code-standard/assets/checklists/backend-api-review-checklist.md

Templates by Domain

按领域分类的模板

Web Application Security

Web应用安全

  • assets/web-application/template-authentication.md — Secure authentication flows (JWT, OAuth2, sessions, MFA)
  • assets/web-application/template-authorization.md — RBAC/ABAC/ReBAC policy patterns
  • assets/web-application/template-authentication.md — 安全身份验证流程（JWT、OAuth2、会话、MFA）
  • assets/web-application/template-authorization.md — RBAC/ABAC/ReBAC策略模式

API Security

API安全

  • assets/api/template-secure-api.md — Secure API gateway, rate limiting, CORS, security headers
  • assets/api/template-secure-api.md — 安全API网关、速率限制、CORS、安全响应头

Cloud-Native Security

云原生安全

  • assets/cloud-native/crypto-security.md — Cryptography usage, key management, HSM integration
  • assets/cloud-native/crypto-security.md — 加密技术使用、密钥管理、HSM集成

Blockchain & Web3 Security

区块链与Web3安全

  • references/smart-contract-security-auditing.md — NEW: Smart contract auditing, vulnerability patterns, formal verification, Solidity security
  • references/smart-contract-security-auditing.md — 新增：智能合约审计、漏洞模式、形式化验证、Solidity安全

Related Skills

相关技能

Security Ecosystem

安全生态

  • ../software-backend/SKILL.md — API implementation patterns and error handling
  • ../software-architecture-design/SKILL.md — Secure system decomposition and dependency design
  • ../ops-devops-platform/SKILL.md — DevSecOps pipelines, secrets management, infrastructure hardening
  • ../software-crypto-web3/SKILL.md — Smart contract security, blockchain vulnerabilities, DeFi patterns
  • ../qa-testing-strategy/SKILL.md — Security testing, SAST/DAST integration, penetration testing
  • ../software-backend/SKILL.md — API实现模式与错误处理
  • ../software-architecture-design/SKILL.md — 安全系统分解与依赖设计
  • ../ops-devops-platform/SKILL.md — DevSecOps流水线、密钥管理、基础设施加固
  • ../software-crypto-web3/SKILL.md — 智能合约安全、区块链漏洞、DeFi模式
  • ../qa-testing-strategy/SKILL.md — 安全测试、SAST/DAST集成、渗透测试

AI/LLM Security

AI/LLM安全

  • ../ai-llm/SKILL.md — LLM security patterns including prompt injection prevention
  • ../ai-mlops/SKILL.md — ML model security, adversarial attacks, privacy-preserving ML
  • ../ai-llm/SKILL.md — LLM安全模式，包括提示注入预防
  • ../ai-mlops/SKILL.md — ML模型安全、对抗性攻击、隐私保护ML

Quality & Resilience

质量与韧性

  • ../qa-resilience/SKILL.md — Resilience, safeguards, failure handling, chaos engineering
  • ../qa-refactoring/SKILL.md — Security-focused refactoring patterns
  • ../qa-resilience/SKILL.md — 韧性、防护措施、故障处理、混沌工程
  • ../qa-refactoring/SKILL.md — 安全聚焦的重构模式

Trend Awareness Protocol

趋势感知协议

IMPORTANT: When users ask recommendation questions about application security, you MUST use WebSearch to check current trends before answering. If WebSearch is unavailable, use 
data/sources.json
+ web browsing and state what you verified vs assumed.
重要提示：当用户询问应用安全相关推荐问题时，必须先通过WebSearch检查当前趋势再作答。若无法使用WebSearch，请结合
data/sources.json
+ 网页浏览，并说明已验证内容与假设内容。

Trigger Conditions

触发条件

  • "What's the best approach for [authentication/authorization]?"
  • "What should I use for [secrets/encryption/API security]?"
  • "What's the latest in application security?"
  • "Current best practices for [OWASP/zero trust/supply chain]?"
  • "Is [security approach] still recommended in 2026?"
  • "What are the latest security vulnerabilities?"
  • "Best auth solution for [use case]?"
  • "[身份验证/授权]的最佳方案是什么？"
  • "[密钥/加密/API安全]应该用什么？"
  • "应用安全的最新趋势是什么？"
  • "[OWASP/零信任/供应链]的当前最佳实践是什么？"
  • "[安全方案]在2026年是否仍推荐使用？"
  • "最新的安全漏洞有哪些？"
  • "[使用场景]的最佳身份验证方案是什么？"

Required Searches

必做搜索

  1. Search: 
    "application security best practices 2026"
  2. Search: 
    "OWASP Top 10 2025 2026"
  3. Search: 
    "[authentication/authorization] trends 2026"
  4. Search: 
    "supply chain security 2026"
  1. 搜索：
    "application security best practices 2026"
  2. 搜索：
    "OWASP Top 10 2025 2026"
  3. 搜索：
    "[authentication/authorization] trends 2026"
  4. 搜索：
    "supply chain security 2026"

What to Report

需报告内容

After searching, provide:
  • Current landscape: What security approaches are standard NOW
  • Emerging threats: New vulnerabilities or attack vectors
  • Deprecated/declining: Approaches that are no longer secure
  • Recommendation: Based on fresh data and current advisories
搜索后需提供：
  • 当前格局：当前主流的安全方案
  • 新兴威胁：新的漏洞或攻击向量
  • 已淘汰/衰退方案：不再安全的方案
  • 推荐方案：基于最新数据和当前建议

Example Topics (verify with fresh search)

示例主题（需通过搜索验证）

  • OWASP Top 10 updates
  • Passkeys and passwordless authentication
  • AI security concerns (prompt injection, model poisoning)
  • Supply chain security (SBOMs, dependency scanning)
  • Zero trust architecture implementation
  • API security (BOLA, broken auth)
  • OWASP Top 10更新
  • Passkeys与无密码身份验证
  • AI安全问题（提示注入、模型投毒）
  • 供应链安全（SBOM、依赖扫描）
  • 零信任架构实施
  • API安全（BOLA、身份验证失效）

Operational Playbooks

操作手册

  • references/operational-playbook.md — Core security principles, OWASP summaries, authentication patterns, and detailed code examples
  • references/operational-playbook.md — 核心安全原则、OWASP摘要、身份验证模式以及详细代码示例