security

Security Patterns

OWASP Top 10 (2021) Checklist

| # | Vulnerability | Prevention | |---|--------------|------------| | A01 | Broken Access Control | RBAC, resource-level auth, CORS | | A02 | Cryptographic Failures | Encrypt at rest/transit, no PII in logs | | A03 | Injection (SQL/NoSQL/XSS/OS) | Parameterized queries, output encoding, CSP | | A04 | Insecure Design | Threat modeling, secure design patterns | | A05 | Security Misconfiguration | Hardened defaults, no debug in prod | | A06 | Vulnerable Components | npm audit, dependency scan, CVE tracking | | A07 | Auth Failures | Rate limiting, MFA, secure session | | A08 | Data Integrity Failures | Input validation, signed updates, CI/CD security | | A09 | Logging & Monitoring Failures | Audit log, alert on anomaly | | A10 | SSRF | URL allowlist, network segmentation |

Input Validation

import { z } from 'zod';

const UserInput = z.object({
  email: z.string().email().max(255),
  name: z.string().min(1).max(100).regex(/^[\w\s-]+$/),
  age: z.number().int().min(0).max(150),
});

// Parameterized query (SQL injection prevention)
const user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);

Auth Best Practices

// Password hashing
import bcrypt from 'bcryptjs';
const hash = await bcrypt.hash(password, 12);
const valid = await bcrypt.compare(password, hash);

// JWT with expiry
const token = jwt.sign({ userId: user.id, role: user.role }, secret, { expiresIn: '24h' });

// Rate limiting on auth endpoints
const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });
app.use('/api/auth', authLimiter);

Secret Detection

# Git hooks ile secret engelleme
grep -rn "sk-\|pk_\|ghp_\|xoxb-\|AKIA" --include="*.ts" --include="*.js" src/
grep -rn "password\s*=\s*['\"]" --include="*.ts" src/

Security Headers

import helmet from 'helmet';
app.use(helmet());
// Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, etc.

Anti-Patterns

| Anti-Pattern | Cozum | |-------------|-------| | Hardcoded secrets | Environment variables | | SQL string concat | Parameterized queries | | No CORS config | Whitelist origins | | Debug mode in prod | NODE_ENV check | | No rate limiting | express-rate-limit |

Pentest Methodology (Overview)

Detayli rehber icin: pentest-methodology skill

5-faz pipeline: Recon > Vuln Analysis > Exploitation > Verification > Report

Proof Levels

| Level | Tanim | |-------|-------| | L1 - Theoretical | Potansiyel risk, exploit edilmemis | | L2 - Demonstrated | Bypass/leak gosterildi | | L3 - Exploited | Tam exploit, veri erisimi | | L4 - Chained | Birden fazla vuln zincirlendi |

Source-to-Sink Taint Tracing

Kullanici input'unun (source) tehlikeli fonksiyona (sink) ulasip ulasamadigini kontrol et:

Source: req.body, req.query, req.params, req.headers, cookies
Sink: db.query(), eval(), exec(), res.redirect(), innerHTML

Kontrol: Source ile Sink arasinda sanitizasyon/validasyon var mi?

Bu yaklasimi her code review'da auth/data islerinde kullan.