// ❌ NEVER: Hardcoded secrets
const API_KEY = "sk_live_abc123";

// ✅ ALWAYS: Use environment variables
const API_KEY = process.env.API_KEY;

// ❌ NEVER: SQL injection vulnerability
const query = `SELECT * FROM users WHERE id = ${userId}`;

// ✅ ALWAYS: Parameterized queries
const query = "SELECT * FROM users WHERE id = ?";
db.query(query, [userId]);

// ❌ NEVER: Weak password validation
if (password.length >= 6) { /* valid */ }

// ✅ ALWAYS: Strong password requirements
if (
  password.length >= 12 &&
  /[A-Z]/.test(password) &&
  /[a-z]/.test(password) &&
  /[0-9]/.test(password) &&
  /[^A-Za-z0-9]/.test(password)
) { /* valid */ }

// Identity verification with MFA
interface AuthenticationService {
  // Primary authentication
  verifyCredentials(username: string, password: string): Promise<Session>;

  // Multi-factor authentication
  verifyMfaToken(sessionId: string, token: string): Promise<boolean>;

  // Continuous authentication
  verifySessionValidity(sessionId: string): Promise<boolean>;
}

// Policy engine for access decisions
class PolicyEngine {
  async evaluateAccess(
    user: User,
    resource: Resource,
    context: Context
  ): Promise<AccessDecision> {
    const riskScore = await this.calculateRiskScore(user, context);
    const policy = await this.getApplicablePolicy(user, resource);

    return {
      allowed: this.checkPermissions(user, resource, policy),
      requiresStepUp: riskScore > RISK_THRESHOLD,
      auditRequired: true,
    };
  }

  private async calculateRiskScore(
    user: User,
    context: Context
  ): Promise<number> {
    let risk = 0;
    if (context.location !== user.knownLocations) risk += 30;
    if (context.device !== user.knownDevices) risk += 20;
    if (context.timeOfDay < 6 || context.timeOfDay > 22) risk += 10;
    return risk;
  }
}

undefined

  # Dependency vulnerability scanning
  - name: Run Snyk
    uses: snyk/actions/node@master
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    with:
      args: --severity-threshold=high

  # SBOM generation
  - name: Generate SBOM
    run: |
      npm install -g @cyclonedx/cyclonedx-npm
      cyclonedx-npm --output-file sbom.json

  # License compliance
  - name: Check Licenses
    run: |
      npm install -g license-checker
      license-checker --production --failOn "GPL;AGPL"

**SBOM Implementation:**

```typescript
// Generate Software Bill of Materials
interface SBOMEntry {
  name: string;
  version: string;
  license: string;
  supplier: string;
  checksum: string;
  vulnerabilities: Vulnerability[];
}

async function generateSBOM(): Promise<SBOM> {
  const dependencies = await analyzeDependencies();
  const vulnerabilities = await scanVulnerabilities(dependencies);

  return {
    components: dependencies.map((dep) => ({
      name: dep.name,
      version: dep.version,
      license: dep.license,
      checksum: calculateChecksum(dep),
      vulnerabilities: vulnerabilities.filter((v) => v.package === dep.name),
    })),
    metadata: {
      timestamp: new Date().toISOString(),
      toolVersion: "1.0.0",
    },
  };
}

undefined

**Kubernetes Security:**

```yaml

**NIST Mapping:**

- @nist-controls: [cm-2, cm-3, cm-7, si-7]

// Rate limiting
import rateLimit from "express-rate-limit";

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per windowMs
  message: "Too many requests from this IP",
  standardHeaders: true,
  legacyHeaders: false,
});

// Input validation with sanitization
import { z } from "zod";
import sanitizeHtml from "sanitize-html";

const CreateUserSchema = z.object({
  email: z.string().email().max(255),
  password: z.string().min(12).max(128),
  name: z
    .string()
    .min(1)
    .max(100)
    .transform((val) => sanitizeHtml(val, { allowedTags: [] })),
});

// Authentication middleware
async function authenticate(
  req: Request,
  res: Response,
  next: NextFunction
) {
  try {
    const token = req.headers.authorization?.split(" ")[1];
    if (!token) {
      throw new UnauthorizedError("No token provided");
    }

    const decoded = await verifyJWT(token);
    const session = await validateSession(decoded.sessionId);

    if (!session.valid) {
      throw new UnauthorizedError("Invalid session");
    }

    req.user = decoded;
    next();
  } catch (error) {
    // @nist au-2 "Audit authentication failures"
    await auditLog.record("auth.failure", {
      ip: req.ip,
      path: req.path,
      error: error.message,
    });
    res.status(401).json({ error: "Unauthorized" });
  }
}

// CORS configuration
const corsOptions = {
  origin: (origin: string, callback: Function) => {
    const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [];
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error("Not allowed by CORS"));
    }
  },
  credentials: true,
  maxAge: 86400,
};

undefined

  # Secret scanning
  - name: TruffleHog Secret Scan
    uses: trufflesecurity/trufflehog@main
    with:
      path: ./
      base: ${{ github.event.repository.default_branch }}
      head: HEAD

  # Static Application Security Testing (SAST)
  - name: Run Semgrep
    uses: returntocorp/semgrep-action@v1
    with:
      config: >-
        p/security-audit
        p/owasp-top-ten
        p/cwe-top-25

  # Dependency scanning
  - name: Run Snyk
    uses: snyk/actions/node@master
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  # Container scanning
  - name: Trivy Container Scan
    uses: aquasecurity/trivy-action@master
    with:
      image-ref: "myapp:${{ github.sha }}"
      format: "sarif"
      output: "trivy-results.sarif"

  # Upload results to GitHub Security
  - name: Upload SARIF
    uses: github/codeql-action/upload-sarif@v2
    with:
      sarif_file: trivy-results.sarif

undefined

// Automated incident response workflow
class IncidentResponseOrchestrator {
  async handleSecurityIncident(incident: SecurityIncident): Promise<void> {
    // 1. Immediate containment
    await this.containThreat(incident);

    // 2. Evidence collection
    const evidence = await this.collectEvidence(incident);

    // 3. Analysis and root cause
    const analysis = await this.analyzeIncident(incident, evidence);

    // 4. Remediation
    await this.remediateVulnerability(analysis);

    // 5. Notification
    await this.notifyStakeholders(incident, analysis);

    // 6. Post-incident review
    await this.schedulePostMortem(incident);
  }

  private async containThreat(incident: SecurityIncident): Promise<void> {
    switch (incident.type) {
      case "compromised-credentials":
        await this.revokeAllSessions(incident.userId);
        await this.resetPassword(incident.userId);
        break;
      case "malicious-traffic":
        await this.blockIPAddress(incident.sourceIP);
        break;
      case "data-exfiltration":
        await this.isolateAffectedSystems(incident.systemIds);
        await this.disableExternalConnections();
        break;
    }
  }
}

// Secure password hashing with Argon2
import argon2 from "argon2";

async function hashPassword(password: string): Promise<string> {
  return argon2.hash(password, {
    type: argon2.argon2id,
    memoryCost: 65536, // 64 MB
    timeCost: 3,
    parallelism: 4,
  });
}

// Secure token generation
import crypto from "crypto";

function generateSecureToken(length: number = 32): string {
  return crypto.randomBytes(length).toString("base64url");
}

// Encryption at rest
import { createCipheriv, createDecipheriv, randomBytes } from "crypto";

class DataEncryption {
  private algorithm = "aes-256-gcm";
  private key: Buffer;

  constructor(secretKey: string) {
    this.key = crypto.scryptSync(secretKey, "salt", 32);
  }

  encrypt(data: string): { encrypted: string; iv: string; tag: string } {
    const iv = randomBytes(16);
    const cipher = createCipheriv(this.algorithm, this.key, iv);

    let encrypted = cipher.update(data, "utf8", "hex");
    encrypted += cipher.final("hex");

    return {
      encrypted,
      iv: iv.toString("hex"),
      tag: cipher.getAuthTag().toString("hex"),
    };
  }

  decrypt(encrypted: string, iv: string, tag: string): string {
    const decipher = createDecipheriv(
      this.algorithm,
      this.key,
      Buffer.from(iv, "hex")
    );
    decipher.setAuthTag(Buffer.from(tag, "hex"));

    let decrypted = decipher.update(encrypted, "hex", "utf8");
    decrypted += decipher.final("utf8");

    return decrypted;
  }
}

// Real-time security monitoring
class SecurityMonitor {
  private metrics: MetricsCollector;
  private alerting: AlertingService;

  async monitorAuthenticationPatterns(): Promise<void> {
    const recentAttempts = await this.getRecentAuthAttempts();

    // Detect brute force attacks
    const bruteForceAttempts = recentAttempts.filter(
      (attempt) => attempt.failures > 5 && attempt.timeWindow < 60000
    );

    if (bruteForceAttempts.length > 0) {
      await this.alerting.send({
        severity: "high",
        type: "brute-force-detected",
        details: bruteForceAttempts,
      });
    }

    // Detect credential stuffing
    const stuffingIndicators = await this.detectCredentialStuffing(
      recentAttempts
    );
    if (stuffingIndicators.length > 0) {
      await this.alerting.send({
        severity: "critical",
        type: "credential-stuffing",
        details: stuffingIndicators,
      });
    }
  }
}

undefined

undefined

// TODO: Add basic example for security-practices
// This example demonstrates core functionality

// TODO: Add advanced example for security-practices
// This example shows production-ready patterns

// TODO: Add integration example showing how security-practices
// works with other systems and services