@dzhechkov/keysarium 1.4.0 → 1.5.0

package/templates/.claude/skills/feature-adr/references/agentic-qe/security-testing.md

@@ -0,0 +1,311 @@
+---
+name: security-testing
+description: "Test for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices."
+category: specialized-testing
+priority: critical
+tokenEstimate: 1200
+agents: [qe-security-scanner, qe-api-contract-validator, qe-quality-analyzer]
+implementation_status: optimized
+optimization_version: 1.0
+last_optimized: 2025-12-02
+dependencies: []
+quick_reference_card: true
+tags: [security, owasp, sast, dast, vulnerabilities, auth, injection]
+trust_tier: 3
+validation:
+  schema_path: schemas/output.json
+  validator_path: scripts/validate-config.json
+  eval_path: evals/security-testing.yaml
+---
+
+# Security Testing
+
+<default_to_action>
+When testing security or conducting audits:
+1. TEST OWASP Top 10 vulnerabilities systematically
+2. VALIDATE authentication and authorization on every endpoint
+3. SCAN dependencies for known vulnerabilities (npm audit)
+4. CHECK for injection attacks (SQL, XSS, command)
+5. VERIFY secrets aren't exposed in code/logs
+
+**Quick Security Checks:**
+- Access control → Test horizontal/vertical privilege escalation
+- Crypto → Verify password hashing, HTTPS, no sensitive data exposed
+- Injection → Test SQL injection, XSS, command injection
+- Auth → Test weak passwords, session fixation, MFA enforcement
+- Config → Check error messages don't leak info
+
+**Critical Success Factors:**
+- Think like an attacker, build like a defender
+- Security is built in, not added at the end
+- Test continuously in CI/CD, not just before release
+</default_to_action>
+
+## Quick Reference Card
+
+### When to Use
+- Security audits and penetration testing
+- Testing authentication/authorization
+- Validating input sanitization
+- Reviewing security configuration
+
+### OWASP Top 10 (2021)
+| # | Vulnerability | Key Test |
+|---|---------------|----------|
+| 1 | Broken Access Control | User A accessing User B's data |
+| 2 | Cryptographic Failures | Plaintext passwords, HTTP |
+| 3 | Injection | SQL/XSS/command injection |
+| 4 | Insecure Design | Rate limiting, session timeout |
+| 5 | Security Misconfiguration | Verbose errors, exposed /admin |
+| 6 | Vulnerable Components | npm audit, outdated packages |
+| 7 | Auth Failures | Weak passwords, no MFA |
+| 8 | Integrity Failures | Unsigned updates, malware |
+| 9 | Logging Failures | No audit trail for breaches |
+| 10 | SSRF | Server fetching internal URLs |
+
+### Tools
+| Type | Tool | Purpose |
+|------|------|---------|
+| SAST | SonarQube, Semgrep | Static code analysis |
+| DAST | OWASP ZAP, Burp | Dynamic scanning |
+| Deps | npm audit, Snyk | Dependency vulnerabilities |
+| Secrets | git-secrets, TruffleHog | Secret scanning |
+
+### Agent Coordination
+- `qe-security-scanner`: Multi-layer SAST/DAST scanning
+- `qe-api-contract-validator`: API security testing
+- `qe-quality-analyzer`: Security code review
+
+---
+
+## Key Vulnerability Tests
+
+### 1. Broken Access Control
+```javascript
+// Horizontal escalation - User A accessing User B's data
+test('user cannot access another user\'s order', async () => {
+  const userAToken = await login('userA');
+  const userBOrder = await createOrder('userB');
+
+  const response = await api.get(`/orders/${userBOrder.id}`, {
+    headers: { Authorization: `Bearer ${userAToken}` }
+  });
+  expect(response.status).toBe(403);
+});
+
+// Vertical escalation - Regular user accessing admin
+test('regular user cannot access admin', async () => {
+  const userToken = await login('regularUser');
+  expect((await api.get('/admin/users', {
+    headers: { Authorization: `Bearer ${userToken}` }
+  })).status).toBe(403);
+});
+```
+
+### 2. Injection Attacks
+```javascript
+// SQL Injection
+test('prevents SQL injection', async () => {
+  const malicious = "' OR '1'='1";
+  const response = await api.get(`/products?search=${malicious}`);
+  expect(response.body.length).toBeLessThan(100); // Not all products
+});
+
+// XSS
+test('sanitizes HTML output', async () => {
+  const xss = '<script>alert("XSS")</script>';
+  await api.post('/comments', { text: xss });
+
+  const html = (await api.get('/comments')).body;
+  expect(html).toContain('&lt;script&gt;');
+  expect(html).not.toContain('<script>');
+});
+```
+
+### 3. Cryptographic Failures
+```javascript
+test('passwords are hashed', async () => {
+  await db.users.create({ email: 'test@example.com', password: 'MyPassword123' });
+  const user = await db.users.findByEmail('test@example.com');
+
+  expect(user.password).not.toBe('MyPassword123');
+  expect(user.password).toMatch(/^\$2[aby]\$\d{2}\$/); // bcrypt
+});
+
+test('no sensitive data in API response', async () => {
+  const response = await api.get('/users/me');
+  expect(response.body).not.toHaveProperty('password');
+  expect(response.body).not.toHaveProperty('ssn');
+});
+```
+
+### 4. Security Misconfiguration
+```javascript
+test('errors don\'t leak sensitive info', async () => {
+  const response = await api.post('/login', { email: 'nonexistent@test.com', password: 'wrong' });
+  expect(response.body.error).toBe('Invalid credentials'); // Generic message
+});
+
+test('sensitive endpoints not exposed', async () => {
+  const endpoints = ['/debug', '/.env', '/.git', '/admin'];
+  for (let ep of endpoints) {
+    expect((await fetch(`https://example.com${ep}`)).status).not.toBe(200);
+  }
+});
+```
+
+### 5. Rate Limiting
+```javascript
+test('rate limiting prevents brute force', async () => {
+  const responses = [];
+  for (let i = 0; i < 20; i++) {
+    responses.push(await api.post('/login', { email: 'test@example.com', password: 'wrong' }));
+  }
+  expect(responses.filter(r => r.status === 429).length).toBeGreaterThan(0);
+});
+```
+
+---
+
+## Security Checklist
+
+### Authentication
+- [ ] Strong password requirements (12+ chars)
+- [ ] Password hashing (bcrypt, scrypt, Argon2)
+- [ ] MFA for sensitive operations
+- [ ] Account lockout after failed attempts
+- [ ] Session ID changes after login
+- [ ] Session timeout
+
+### Authorization
+- [ ] Check authorization on every request
+- [ ] Least privilege principle
+- [ ] No horizontal escalation
+- [ ] No vertical escalation
+
+### Data Protection
+- [ ] HTTPS everywhere
+- [ ] Encrypted at rest
+- [ ] Secrets not in code/logs
+- [ ] PII compliance (GDPR)
+
+### Input Validation
+- [ ] Server-side validation
+- [ ] Parameterized queries (no SQL injection)
+- [ ] Output encoding (no XSS)
+- [ ] Rate limiting
+
+---
+
+## CI/CD Integration
+
+```yaml
+# GitHub Actions
+security-checks:
+  steps:
+    - name: Dependency audit
+      run: npm audit --audit-level=high
+
+    - name: SAST scan
+      run: npm run sast
+
+    - name: Secret scan
+      uses: trufflesecurity/trufflehog@main
+
+    - name: DAST scan
+      if: github.ref == 'refs/heads/main'
+      run: docker run owasp/zap2docker-stable zap-baseline.py -t https://staging.example.com
+```
+
+**Pre-commit hooks:**
+```bash
+#!/bin/sh
+git-secrets --scan
+npm run lint:security
+```
+
+---
+
+## Agent-Assisted Security Testing
+
+```typescript
+// Comprehensive multi-layer scan
+await Task("Security Scan", {
+  target: 'src/',
+  layers: { sast: true, dast: true, dependencies: true, secrets: true },
+  severity: ['critical', 'high', 'medium']
+}, "qe-security-scanner");
+
+// OWASP Top 10 testing
+await Task("OWASP Scan", {
+  categories: ['broken-access-control', 'injection', 'cryptographic-failures'],
+  depth: 'comprehensive'
+}, "qe-security-scanner");
+
+// Validate fix
+await Task("Validate Fix", {
+  vulnerability: 'CVE-2024-12345',
+  expectedResolution: 'upgrade package to v2.0.0',
+  retestAfterFix: true
+}, "qe-security-scanner");
+```
+
+---
+
+## Agent Coordination Hints
+
+### Memory Namespace
+```
+aqe/security/
+├── scans/*           - Scan results
+├── vulnerabilities/* - Found vulnerabilities
+├── fixes/*           - Remediation tracking
+└── compliance/*      - Compliance status
+```
+
+### Fleet Coordination
+```typescript
+const securityFleet = await FleetManager.coordinate({
+  strategy: 'security-testing',
+  agents: [
+    'qe-security-scanner',
+    'qe-api-contract-validator',
+    'qe-quality-analyzer',
+    'qe-deployment-readiness'
+  ],
+  topology: 'parallel'
+});
+```
+
+---
+
+## Common Mistakes
+
+### ❌ Security by Obscurity
+Hiding admin at `/super-secret-admin` → **Use proper auth**
+
+### ❌ Client-Side Validation Only
+JavaScript validation can be bypassed → **Always validate server-side**
+
+### ❌ Trusting User Input
+Assuming input is safe → **Sanitize, validate, escape all input**
+
+### ❌ Hardcoded Secrets
+API keys in code → **Environment variables, secret management**
+
+---
+
+## Related Skills
+- [agentic-quality-engineering](../agentic-quality-engineering/) - Security with agents
+- [api-testing-patterns](../api-testing-patterns/) - API security testing
+- [compliance-testing](../compliance-testing/) - GDPR, HIPAA, SOC2
+
+---
+
+## Remember
+
+**Think like an attacker:** What would you try to break? Test that.
+**Build like a defender:** Assume input is malicious until proven otherwise.
+**Test continuously:** Security testing is ongoing, not one-time.
+
+**With Agents:** Agents automate vulnerability scanning, track remediation, and validate fixes. Use agents to maintain security posture at scale.

package/templates/.claude/skills/feature-adr/references/agentic-qe/shift-left-testing.md

@@ -0,0 +1,231 @@
+---
+name: shift-left-testing
+description: "Move testing activities earlier in the development lifecycle to catch defects when they're cheapest to fix. Use when implementing TDD, CI/CD, or early quality practices."
+category: testing-methodologies
+priority: high
+tokenEstimate: 900
+agents: [qe-test-generator, qe-requirements-validator, qe-regression-risk-analyzer]
+implementation_status: optimized
+optimization_version: 1.0
+last_optimized: 2025-12-02
+dependencies: []
+quick_reference_card: true
+tags: [shift-left, early-testing, tdd, bdd, ci-cd, prevention]
+trust_tier: 3
+validation:
+  schema_path: schemas/output.json
+  validator_path: scripts/validate-config.json
+  eval_path: evals/shift-left-testing.yaml
+
+---
+
+# Shift-Left Testing
+
+<default_to_action>
+When implementing early testing practices:
+1. VALIDATE requirements before coding (testability, BDD scenarios)
+2. WRITE tests before implementation (TDD red-green-refactor)
+3. AUTOMATE in CI pipeline (every commit triggers tests)
+4. FOLLOW test pyramid: Many unit (70%), some integration (20%), few E2E (10%)
+5. FIX defects immediately - never let them accumulate
+
+**Quick Shift-Left Levels:**
+- Level 1: Unit tests with each PR (developer responsibility)
+- Level 2: TDD practice (tests before code)
+- Level 3: BDD/Example mapping in refinement (requirements testing)
+- Level 4: Risk analysis in design (architecture testing)
+
+**Critical Success Factors:**
+- Defects found in requirements cost 1x; in production cost 100x
+- Every commit must run automated tests
+- Quality is built in, not tested in
+</default_to_action>
+
+## Quick Reference Card
+
+### When to Use
+- Reducing cost of defects
+- Implementing CI/CD pipelines
+- Starting TDD practice
+- Improving requirements quality
+
+### Cost of Defects by Phase
+| Phase | Relative Cost | Example |
+|-------|--------------|---------|
+| Requirements | 1x | Fix doc: 30 min |
+| Design | 5x | Redesign: few hours |
+| Development | 10x | Code fix: 1 day |
+| Testing | 20x | Fix + retest: 2 days |
+| Production | 100x | Hotfix + rollback + investigation |
+
+### Test Pyramid
+```
+       /\        E2E (10%) - Critical user journeys
+      /  \
+     /    \      Integration (20%) - Component interactions
+    /      \
+   /________\    Unit (70%) - Fast, isolated, comprehensive
+```
+
+### Shift-Left Levels
+| Level | Practice | When |
+|-------|----------|------|
+| 1 | Unit tests in PR | Before merge |
+| 2 | TDD | Before implementation |
+| 3 | BDD/Example Mapping | During refinement |
+| 4 | Risk Analysis | During design |
+
+---
+
+## Level 1: Tests in Every PR
+
+```yaml
+# CI pipeline - tests run on every commit
+name: CI
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+      - run: npm run test:unit
+      - run: npm run test:integration
+      - run: npm run lint
+
+  quality-gate:
+    needs: test
+    steps:
+      - name: Coverage Check
+        run: npx coverage-check --min 80
+      - name: No New Warnings
+        run: npm run lint -- --max-warnings 0
+```
+
+---
+
+## Level 2: TDD Practice
+
+```javascript
+// Red: Write failing test first
+test('calculates discount for orders over $100', () => {
+  const order = new Order([{ price: 150 }]);
+  expect(order.discount).toBe(15); // 10% off
+});
+
+// Green: Minimal implementation
+class Order {
+  get discount() {
+    return this.total > 100 ? this.total * 0.1 : 0;
+  }
+}
+
+// Refactor: Improve while keeping green
+```
+
+---
+
+## Level 3: BDD in Refinement
+
+```gherkin
+# Example mapping before coding
+Feature: Loyalty Discount
+  Scenario: Gold member gets 15% discount
+    Given a customer with "gold" membership
+    When they checkout with $200 in cart
+    Then discount applied is $30
+    And order total is $170
+
+  Scenario: New customer gets no discount
+    Given a customer with no membership
+    When they checkout with $200 in cart
+    Then no discount is applied
+```
+
+---
+
+## Level 4: Risk Analysis in Design
+
+```typescript
+// During architecture review
+await Task("Risk Analysis", {
+  phase: 'design',
+  component: 'payment-service',
+  questions: [
+    'What happens when payment gateway times out?',
+    'How do we handle duplicate submissions?',
+    'What if inventory changed during checkout?'
+  ]
+}, "qe-requirements-validator");
+
+// Output: Testability requirements, failure mode tests
+```
+
+---
+
+## Agent-Assisted Shift-Left
+
+```typescript
+// Validate requirements testability
+await Task("Requirements Validation", {
+  requirements: userStories,
+  check: ['INVEST-criteria', 'testability', 'ambiguity'],
+  generateBDD: true
+}, "qe-requirements-validator");
+
+// Generate tests from requirements
+await Task("Generate Tests", {
+  source: 'requirements',
+  types: ['unit', 'integration', 'e2e'],
+  coverage: 'comprehensive'
+}, "qe-test-generator");
+
+// Smart test selection for changes
+await Task("Select Regression Tests", {
+  changedFiles: prFiles,
+  algorithm: 'risk-based',
+  targetReduction: 0.7  // 70% time savings
+}, "qe-regression-risk-analyzer");
+```
+
+---
+
+## Agent Coordination Hints
+
+### Memory Namespace
+```
+aqe/shift-left/
+├── requirements/*       - Validated requirements
+├── generated-tests/*    - Auto-generated tests
+├── coverage-targets/*   - Coverage goals by component
+└── pipeline-results/*   - CI/CD test history
+```
+
+### Fleet Coordination
+```typescript
+const shiftLeftFleet = await FleetManager.coordinate({
+  strategy: 'shift-left',
+  agents: [
+    'qe-requirements-validator',     // Level 3-4
+    'qe-test-generator',             // Level 2
+    'qe-regression-risk-analyzer'    // Smart selection
+  ],
+  topology: 'sequential'
+});
+```
+
+---
+
+## Related Skills
+- [tdd-london-chicago](../tdd-london-chicago/) - TDD practices
+- [holistic-testing-pact](../holistic-testing-pact/) - Proactive testing
+- [cicd-pipeline-qe-orchestrator](../cicd-pipeline-qe-orchestrator/) - Pipeline integration
+- [shift-right-testing](../shift-right-testing/) - Production feedback
+
+---
+
+## Remember
+
+**Earlier = Cheaper.** Requirements defects cost 1x; production defects cost 100x. Test pyramid: 70% unit, 20% integration, 10% E2E. Every commit runs tests. TDD builds quality in.
+
+**With Agents:** Agents validate requirements testability, generate tests from specs, and select optimal regression suites. Use agents to implement shift-left practices consistently.