@dzhechkov/keysarium 1.7.18 → 1.7.20

package/templates/.claude/skills/feature-adr/references/agentic-qe/qe-ref-security-testing/references/compliance-agent-commands.md

@@ -0,0 +1,131 @@
+# Security Testing — Compliance & Agent CLI Commands
+
+Merged from `qe-security-compliance`. Use these for v3 agent-specific security/compliance capabilities.
+
+## AQE CLI Commands
+
+```bash
+# Full security scan
+aqe security scan --scope src/ --checks all
+
+# Vulnerability check
+aqe security vulns --dependencies --severity critical,high
+
+# Compliance audit
+aqe security compliance --standard soc2 --output report.html
+
+# OWASP check
+aqe security owasp --top-10 --scope src/
+```
+
+## Agent Workflow
+
+```typescript
+// Security audit
+Task("Security audit", `
+  Perform comprehensive security audit:
+  - SAST scan for code vulnerabilities
+  - Dependency vulnerability check
+  - Secret detection in code and configs
+  - OWASP Top 10 validation
+  Generate security report with remediation steps.
+`, "qe-security-auditor")
+
+// Compliance validation
+Task("SOC2 compliance check", `
+  Validate SOC2 compliance requirements:
+  - Access control verification
+  - Encryption validation
+  - Audit logging check
+  - Data retention compliance
+  Generate compliance evidence report.
+`, "qe-compliance-checker")
+```
+
+## SAST Scanning
+
+```typescript
+await securityScanner.staticAnalysis({
+  scope: 'src/**/*.ts',
+  checks: ['sql-injection', 'xss', 'command-injection', 'path-traversal', 'insecure-crypto', 'hardcoded-secrets'],
+  rules: 'owasp-top-10',
+  severity: ['critical', 'high', 'medium']
+});
+```
+
+## Dependency Scanning
+
+```typescript
+await securityScanner.dependencyCheck({
+  sources: ['package.json', 'package-lock.json'],
+  checks: { knownVulnerabilities: true, outdatedPackages: true, licenseCompliance: true, supplyChainRisk: true },
+  severity: ['critical', 'high'],
+  autoFix: { enabled: true, dryRun: false }
+});
+```
+
+## Compliance Audit
+
+```typescript
+await complianceChecker.audit({
+  standards: ['SOC2', 'GDPR', 'HIPAA'],
+  scope: { code: 'src/', configs: 'config/', infrastructure: 'terraform/' },
+  output: { gaps: true, evidence: true, recommendations: true }
+});
+```
+
+## Secret Detection
+
+```typescript
+await securityScanner.detectSecrets({
+  scope: ['.', 'config/', '.env*'],
+  patterns: ['api-keys', 'passwords', 'tokens', 'private-keys', 'connection-strings'],
+  exclude: ['*.test.ts', 'mocks/'],
+  action: { onDetect: 'block', notify: ['security-team'] }
+});
+```
+
+## Security Gates
+
+```yaml
+security_gates:
+  block_merge:
+    - critical_vulnerabilities > 0
+    - high_vulnerabilities > 2
+    - secrets_detected > 0
+    - compliance_failures > 0
+  warn:
+    - medium_vulnerabilities > 5
+    - outdated_dependencies > 10
+  enforce:
+    - signed_commits: required
+    - code_review: required
+    - security_scan: required
+```
+
+## Compliance Standards Coverage
+
+| Standard | Scope | Auto-Check |
+|----------|-------|------------|
+| SOC2 | Security controls | Partial |
+| GDPR | Data privacy | Partial |
+| HIPAA | Health data | Partial |
+| PCI-DSS | Payment data | Yes |
+| ISO 27001 | InfoSec | Partial |
+
+## Security Report Interface
+
+```typescript
+interface SecurityReport {
+  summary: { score: number; critical: number; high: number; medium: number; low: number };
+  vulnerabilities: { id: string; type: string; severity: string; location: string; description: string; remediation: string; cwe: string; owasp: string }[];
+  dependencies: { vulnerable: number; outdated: number; details: DependencyVuln[] };
+  compliance: { standard: string; status: 'compliant' | 'non-compliant' | 'partial'; gaps: ComplianceGap[]; evidence: Evidence[] }[];
+  secrets: { detected: number; locations: SecretLocation[] };
+}
+```
+
+## Coordination
+
+**Primary Agents**: qe-security-auditor, qe-security-scanner, qe-compliance-checker
+**Coordinator**: qe-security-coordinator

package/templates/.claude/skills/feature-adr/references/agentic-qe/qe-ref-security-testing/references/owasp-top-10.md

@@ -0,0 +1,66 @@
+# OWASP Top 10 (2021) Quick Reference
+
+## A01: Broken Access Control
+- Test: Horizontal privilege escalation (user A accessing user B's data)
+- Test: Vertical privilege escalation (user accessing admin endpoints)
+- Test: IDOR on every object reference (change IDs in URLs/params)
+- Test: Missing function-level access control on API endpoints
+- Common miss: Admin APIs accessible without auth check
+
+## A02: Cryptographic Failures
+- Test: TLS version (require 1.2+, reject 1.0/1.1)
+- Test: Password hashing (bcrypt/argon2, never MD5/SHA1)
+- Test: Sensitive data in URLs/logs/error messages
+- Test: Cookie flags (Secure, HttpOnly, SameSite)
+- Common miss: API keys in client-side JavaScript
+
+## A03: Injection
+- Test: SQL injection on all input fields (parameterized queries?)
+- Test: XSS (reflected, stored, DOM-based) — try `<script>alert(1)</script>` and encoded variants
+- Test: Command injection on any server-side exec
+- Test: NoSQL injection on MongoDB queries
+- Common miss: Second-order SQL injection via stored data
+
+## A04: Insecure Design
+- Test: Business logic flaws (negative quantities, race conditions)
+- Test: Missing rate limiting on sensitive endpoints
+- Test: Lack of resource quotas
+- Common miss: Discount codes applied multiple times
+
+## A05: Security Misconfiguration
+- Test: Default credentials on all services
+- Test: Unnecessary HTTP methods (OPTIONS, TRACE)
+- Test: Directory listing enabled
+- Test: Stack traces in error responses
+- Common miss: S3 bucket with public ACL
+
+## A06: Vulnerable Components
+- Test: `npm audit` / `snyk test` for known CVEs
+- Test: Outdated framework versions
+- Test: Abandoned dependencies (no updates in 2+ years)
+- Common miss: Transitive dependencies with critical CVEs
+
+## A07: Auth Failures
+- Test: Credential stuffing protection (rate limiting, captcha)
+- Test: Session fixation (new session ID after login)
+- Test: JWT validation (algorithm confusion, expiry, signature)
+- Test: MFA bypass attempts
+- Common miss: Password reset token doesn't expire
+
+## A08: Software/Data Integrity
+- Test: CI/CD pipeline integrity (signed commits, reviewed PRs)
+- Test: Dependency integrity (lock files, SRI hashes)
+- Test: Deserialization attacks
+- Common miss: Auto-update mechanism without signature verification
+
+## A09: Logging/Monitoring Failures
+- Test: Failed login attempts logged with IP
+- Test: Sensitive data NOT in logs (passwords, tokens)
+- Test: Log injection prevention
+- Common miss: No alerting on repeated auth failures
+
+## A10: SSRF
+- Test: URL parameters that fetch external resources
+- Test: Internal network access via URL manipulation
+- Test: Cloud metadata endpoint access (169.254.169.254)
+- Common miss: Redirect chains bypassing allowlists