coding-os 0.3.2__py3-none-any.whl

core/skills/security-mobile/assets/mobile-security-checklist.md

@@ -0,0 +1,117 @@
+# Mobile Security Pre-Submission Checklist
+
+Run before TestFlight / Play Internal Testing. Each item is a concrete check; uncheck → block release.
+
+## Storage
+
+- [ ] All auth tokens stored via `react-native-keychain` (NOT `AsyncStorage`, NOT plain `MMKV`).
+- [ ] Refresh tokens stored same way.
+- [ ] OAuth tokens (Google/Apple ID tokens) NEVER persisted client-side after exchange.
+- [ ] Per-install MMKV encryption key stored in Keychain (if encrypted MMKV used).
+- [ ] PII in encrypted DB (SQLCipher) OR clearly classified as non-sensitive.
+- [ ] No hardcoded API secrets in source / build artifacts.
+- [ ] No `.env` checked into the repo (every dev key separate from prod).
+- [ ] Backup excluded for sensitive files: iOS sets `WHEN_UNLOCKED_THIS_DEVICE_ONLY`; Android `<exclude>` rules set.
+
+## Network
+
+- [ ] HTTPS-only — `Info.plist` ATS unrelaxed.
+- [ ] Android `network_security_config.xml` rejects cleartext traffic globally.
+- [ ] Certificate pinning decision documented (pinned with rotation plan, OR explicit "not pinning, here's why").
+- [ ] If pinning: 2 SPKI hashes (current + backup), pin failure shows recoverable error.
+- [ ] No HTTP fallback for any API endpoint.
+- [ ] mitmproxy / Charles dev test: only TLS traffic, no cleartext.
+- [ ] No PII in URL query parameters (logs, history leak).
+- [ ] No tokens in URL paths.
+
+## Authentication
+
+- [ ] Sign In with Apple offered if any other social provider is offered (App Store rule).
+- [ ] OAuth flows use PKCE.
+- [ ] OAuth callbacks open in native browser tab (Custom Tabs / SFSafariViewController), NOT WebView.
+- [ ] Magic-link / password-reset deep links validate token shape before action.
+- [ ] Magic-link / password-reset show confirmation UI before mutating state ("you'll sign in as user@example.com").
+- [ ] Biometric prompt for app unlock with passcode fallback.
+- [ ] Re-prompt biometric on background > 60 seconds (banking-style).
+- [ ] Step-up authentication for sensitive ops (transfer, change password, disable 2FA).
+
+## Permissions
+
+- [ ] iOS: every permission has `NSXxxUsageDescription` explaining WHY.
+- [ ] Android: every permission has clear justification; sensitive ones (BIND_ACCESSIBILITY_SERVICE, QUERY_ALL_PACKAGES) declared in Play Console form.
+- [ ] Permissions requested in context, not on first launch.
+- [ ] Soft-prompt before OS prompt for non-trivial permissions.
+- [ ] No third-party SDK silently adding permissions you don't need (audit merged manifest).
+
+## Code Quality
+
+- [ ] `console.*` stripped from release builds (`babel-plugin-transform-remove-console`).
+- [ ] Sensitive headers (Authorization) NOT logged by API client even in dev.
+- [ ] Sentry / Crashlytics `beforeSend` scrubs PII.
+- [ ] `__DEV__` guard around dev-only screens / panels (Reactotron, debug menus).
+- [ ] No `debuggable=true` in release Android build.
+- [ ] R8/ProGuard enabled with rules for native modules + reflection-using libs.
+- [ ] iOS app NOT signed with development cert in release (Distribution cert from team).
+
+## WebViews (if used)
+
+- [ ] WebView allowlist of acceptable origins.
+- [ ] `setAllowFileAccess(false)` (Android), `WKWebViewConfiguration.allowsContentJavaScript=true` only when needed (iOS).
+- [ ] No app credentials (cookies / tokens) leaked into WebView origin.
+- [ ] PostMessage handlers validate `event.origin`.
+
+## Deep Links
+
+- [ ] Universal Links / App Links configured (HTTPS-served, AASA + assetlinks.json verified).
+- [ ] Custom-scheme fallback validated; no auth flows rely solely on `app://` scheme.
+- [ ] Every deep-link param shape regex-validated.
+- [ ] NotFound route catches malformed URLs without crashing.
+
+## App-Switcher / Background
+
+- [ ] Sensitive screens redact in `inactive` state (iOS app switcher).
+- [ ] Optional: Android `FLAG_SECURE` on screens with extreme sensitivity.
+
+## SDK / Dependency Audit
+
+- [ ] `yarn audit` / `npm audit` passes with no high-severity issues.
+- [ ] No new dependencies added without 1-paragraph justification in PR.
+- [ ] Major-version locked in `package.json`; minor/patch reviewed before bump.
+- [ ] No SDK that requests permissions unrelated to its job (analytics asking for location, etc.).
+
+## Build / Release
+
+- [ ] iOS: deployment target ≥ 16. Distribution cert + provisioning profile valid.
+- [ ] Android: `targetSdkVersion` = current Play floor, `minSdkVersion` ≥ 24.
+- [ ] App Bundle (`.aab`) for Play, IPA for App Store.
+- [ ] Play App Signing enabled.
+- [ ] dSYM (iOS) + mapping file (Android) uploaded to crash reporter for symbolication.
+- [ ] No `* (Apple Wildcard)` provisioning profile in release build.
+- [ ] No production API URL accidentally in dev build (and vice versa).
+
+## Pre-Flight Verification
+
+- [ ] **MobSF scan** of release build — no high-severity issues.
+- [ ] **Filesystem audit** — install on test device, inspect app sandbox, confirm no plaintext tokens / PII.
+- [ ] **Backup audit** — back up to iCloud/Google, restore on fresh device, confirm no sensitive data crosses.
+- [ ] **mitmproxy capture** — only TLS, no PII in URLs, all expected headers present.
+- [ ] **OS-level smoke** — VoiceOver/TalkBack passes on auth flows; Dynamic Type ≤ accessibility5 doesn't break.
+- [ ] **Cold-start crash check** — install fresh, launch, verify no crash on the slowest supported device.
+
+## Logout / Account Deletion
+
+- [ ] Logout button visible in Settings.
+- [ ] Logout calls server `/auth/logout` AND wipes Keychain AND resets Zustand stores AND navigates to sign-in.
+- [ ] Account deletion path exists (App Store + Play Store BOTH require this).
+- [ ] Account deletion confirms with "this is permanent" prompt.
+- [ ] Account deletion server-side: revokes all sessions + refresh tokens, marks user `deleted_at`, schedules data purge per data-retention policy.
+
+## Failure Surfaces
+
+- [ ] Network failure shows actionable error (not "Error" with no detail).
+- [ ] Pin failure shows "couldn't verify connection — please update".
+- [ ] Sign-in failure shows generic "couldn't sign in" (no enumeration via "user not found" vs "wrong password").
+
+---
+
+If any box is unchecked, document the reason in a tracking issue with an ETA. Mobile security bugs ship for the lifetime of an app version — slow to recall, slow to update.

core/skills/security-mobile/references/masvs-l1-checklist.md

@@ -0,0 +1,127 @@
+# OWASP MASVS L1 — Per-Requirement Checklist
+
+OWASP MASVS v2.0 Level 1 covers the security baseline for all mobile apps. Higher levels (L2 = sensitive data, L3 = nation-state) layer on top. Most consumer apps meet L1.
+
+Each requirement maps to a concrete check or implementation.
+
+## MASVS-STORAGE — Secure Data Storage
+
+- [ ] **MASVS-STORAGE-1**: The app uses an appropriate platform mechanism (Keychain / Keystore) to store sensitive data.
+  - Tokens in `react-native-keychain`, never in `AsyncStorage` or unencrypted MMKV.
+  - TOTP shared secrets NOT stored on the device — server-side only, KMS-encrypted.
+
+- [ ] **MASVS-STORAGE-2**: The app does not write sensitive data to system logs or shared storage.
+  - `console.*` stripped from release builds.
+  - No `Log.d(TAG, sessionToken)`, no `NSLog(@"%@", token)`.
+  - SQLite databases either NOT containing sensitive data, or encrypted (SQLCipher).
+  - `android:allowBackup="false"` OR `<exclude domain="sharedpref" path="auth.xml" />` in backup rules.
+  - iOS: sensitive Keychain items use `WHEN_UNLOCKED_THIS_DEVICE_ONLY` (not backed up).
+
+## MASVS-CRYPTO — Cryptography
+
+- [ ] **MASVS-CRYPTO-1**: The app uses cryptography for an explicit security need (no "encryption theater").
+  - You can articulate WHY each crypto operation exists.
+  - You're not "obfuscating" data with XOR or base64 and calling it encryption.
+
+- [ ] **MASVS-CRYPTO-2**: The app uses current, industry-vetted cryptographic primitives.
+  - AES-GCM, not AES-ECB.
+  - Key derivation: PBKDF2 (≥600k iterations in 2026) or scrypt or Argon2.
+  - No MD5, SHA-1, RC4, DES, 3DES.
+  - No homegrown crypto.
+
+## MASVS-AUTH — Authentication and Session Management
+
+- [ ] **MASVS-AUTH-1**: The app uses secure authentication and authorization protocols.
+  - See `auth-patterns` skill — passkeys / OAuth 2.1+PKCE / opaque sessions.
+  - No HTTP Basic Auth.
+
+- [ ] **MASVS-AUTH-2**: Local authentication (biometric / passcode) is invocable when needed.
+  - `BIOMETRY_ANY_OR_DEVICE_PASSCODE` for app unlock.
+  - Step-up auth for sensitive ops.
+
+- [ ] **MASVS-AUTH-3**: The app secures sensitive operations and data with additional authentication.
+  - Money transfers, password change, 2FA disable: re-prompt biometric or password.
+
+## MASVS-NETWORK — Network Communication
+
+- [ ] **MASVS-NETWORK-1**: The app secures all network traffic according to the current best practices.
+  - HTTPS-only (TLS 1.2+; prefer TLS 1.3).
+  - iOS ATS enabled, no exemption domains.
+  - Android Network Security Config with `cleartextTrafficPermitted=false`.
+
+- [ ] **MASVS-NETWORK-2**: The app performs identity pinning where applicable.
+  - Pin SPKI hashes (current + backup key) for high-value endpoints.
+  - OR: explicit decision to NOT pin, documented, with rationale.
+
+## MASVS-PLATFORM — Platform Interaction
+
+- [ ] **MASVS-PLATFORM-1**: The app uses IPC mechanisms securely.
+  - Android: `exported="false"` on all Activities/Services/Receivers/Providers unless you mean to expose them.
+  - iOS: URL scheme handlers validate input; no blind dispatch.
+
+- [ ] **MASVS-PLATFORM-2**: The app only uses WebViews securely.
+  - `setJavaScriptEnabled(true)` only when needed.
+  - `setAllowFileAccess(false)`, `setAllowContentAccess(false)`, `setAllowFileAccessFromFileURLs(false)`.
+  - Origin allowlist for `postMessage` recipients.
+  - No mixing app credentials into WebView (cookies, localStorage).
+
+- [ ] **MASVS-PLATFORM-3**: The app protects against deep-link / Intent injection.
+  - Validate every deep-link param shape (regex / type guards).
+  - Authentication-relevant deep links (magic link, password reset): single-use server-side, render confirmation UI before action.
+
+## MASVS-CODE — Code Quality
+
+- [ ] **MASVS-CODE-1**: The app requires up-to-date platform versions.
+  - iOS deployment target ≥ 16 (covers passkeys + modern privacy APIs).
+  - Android `minSdkVersion` ≥ 24, `targetSdkVersion` = current Play requirement (35 in 2026).
+
+- [ ] **MASVS-CODE-2**: The app has a mechanism for forcing app updates.
+  - Server returns a `min_app_version` header / endpoint.
+  - Client refuses to function (or shows update prompt) when below.
+  - Use force-update sparingly; only for security fixes.
+
+- [ ] **MASVS-CODE-3**: The app is signed and provisioned correctly.
+  - iOS: distribution certificate from your team, no jailbroken bypasses.
+  - Android: Play App Signing enabled.
+
+- [ ] **MASVS-CODE-4**: The app uses up-to-date third-party libraries with known vulnerabilities patched.
+  - `yarn audit` / `npm audit` weekly, with a clear "no high-severity unfixed" policy.
+  - Pin major versions; review minor/patch upgrades.
+  - Cap transitive dependencies via `resolutions` in `package.json`.
+
+## MASVS-RESILIENCE — Resilience
+
+(L1 doesn't require RESILIENCE; included for completeness if you target L2.)
+
+- **MASVS-RESILIENCE-1**: The app validates the integrity of the platform.
+  - Optional root/jailbreak detection (JailMonkey).
+  - Optional integrity attestation (Play Integrity API on Android, DeviceCheck / App Attest on iOS).
+
+- **MASVS-RESILIENCE-2**: The app implements anti-tampering / anti-debug.
+  - Optional. Most consumer apps skip. Add for high-value targets.
+
+- **MASVS-RESILIENCE-3**: The app implements anti-static-analysis.
+  - R8/ProGuard for Android (most apps).
+  - iOS Swift code is harder to reverse than Obj-C; standard.
+  - Don't bother with serious obfuscation unless threat model demands it.
+
+- **MASVS-RESILIENCE-4**: The app detects and responds to runtime tampering.
+  - Optional. Frida detection, debugger detection, etc. Brittle — best-effort.
+
+## Production Verification
+
+Before each release, run:
+
+1. **MobSF** (`docker run -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest`) — upload the IPA / AAB and review the report.
+2. **`yarn audit --groups dependencies` / `pnpm audit`** — fail the build on high-severity.
+3. **`grep -r "console\." mobile/src/` after build** — should be zero in release bundle.
+4. **Network capture with mitmproxy** in dev — verify TLS, no cleartext, no PII in URLs.
+5. **Backup audit** — restore from iCloud / Google to a fresh device; verify no sensitive data crosses.
+
+## Source Material
+
+- OWASP — *MASVS v2.0*: <https://mas.owasp.org/MASVS/>
+- OWASP — *MASTG*: <https://mas.owasp.org/MASTG/> (test cases per requirement)
+- *MobSF* — automated scanner: <https://github.com/MobSF/Mobile-Security-Framework-MobSF>
+- Apple — *Security Overview*: <https://support.apple.com/guide/security/welcome/web>
+- Android — *App Security Best Practices*: <https://developer.android.com/topic/security/best-practices>

core/skills/security-web/SKILL.md

@@ -0,0 +1,217 @@
+---
+name: security-web
+tier: cross-cutting
+domain: [security]
+description: Server-side / API-side security per OWASP Top-10 (2025 release). Use when writing or reviewing backend code (Go+Fiber business core, Python+FastAPI AI adapter, Node) for broken access control, security misconfiguration, supply-chain failures, cryptographic mistakes, injection, insecure design, authentication failures, integrity failures, logging/alerting gaps, mishandling of exceptional conditions, plus SSRF/CSRF/XXE/SSTI/secrets/headers (CSP/HSTS/COOP/COEP) and JWT pitfalls. Pairs with auth-patterns and security-mobile.
+last_reviewed: "2026-05-11"
+
+---
+
+# Web / Backend Security — OWASP Top-10 (2025) + 2026 Practice
+
+A practical playbook for hardening server-side code. Anchored on **OWASP Top-10 (2025)** — released November 2025, the current standard, replaces the 2021 list. Targets the project's stack — Go+Fiber business backend + Python+FastAPI AI adapter + PostgreSQL — with concrete code per category.
+
+## When to Use This Skill
+
+- Writing or reviewing any backend route / handler / middleware.
+- Adding a new third-party SDK / dependency.
+- Setting up TLS / HSTS / CSP headers.
+- Auditing existing code for OWASP categories.
+- Pre-launch security review.
+- Investigating a security incident or pentest finding.
+
+For client-side mobile hardening, see `security-mobile`. For auth specifically, see `auth-patterns`.
+
+## OWASP Top-10 (2025) — Per Category
+
+The full per-category walk-through with concrete defenses + code samples is in [references/owasp-top-10.md](references/owasp-top-10.md). The skim summary, in 2025 ranking order:
+
+| ID | Category | 2021 → 2025 change | Top defense |
+|---|---|---|---|
+| A01 | **Broken Access Control** | same #1 | Default deny; use case asserts ownership; multi-tenant via Postgres RLS |
+| A02 | **Security Misconfiguration** | ↑ from #5 to #2 | Security headers; no DEBUG in prod; default admin paths protected; least-privilege containers |
+| A03 | **Software Supply Chain Failures** | renamed + expanded from "Vulnerable & Outdated Components" (was #6) | SBOM per release; pin commits not tags in CI; OIDC short-lived tokens; staged rollouts; MFA on registry/repo accounts |
+| A04 | **Cryptographic Failures** | ↓ from #2 to #4 | TLS 1.2+; Argon2id for passwords; SHA-256 for refresh-token hashing; KMS-encrypted PII |
+| A05 | **Injection** | ↓ from #3 to #5 | Parameterized queries everywhere; never concat user input into SQL/shell/templates |
+| A06 | **Insecure Design** | ↓ from #4 to #6 | Server-authoritative checks; idempotency; rate limiting; threat modeling |
+| A07 | **Authentication Failures** | renamed (was "Identification and Authentication Failures") | See `auth-patterns` skill |
+| A08 | **Software or Data Integrity Failures** | same #8 | No insecure deserialization; signed updates; pinned action SHAs |
+| A09 | **Security Logging and Alerting Failures** | renamed (was "Monitoring") | Auth events logged with request_id; alerts on anomalies; runbooks per alert |
+| A10 | **Mishandling of Exceptional Conditions** | **NEW in 2025** | Catch at source; fail-closed transactions; centralized error handler; resource cleanup in `finally` |
+
+**SSRF** (A10:2021) **dropped out** of the Top 10 — still a real risk, now treated under **Insecure Design (A06:2025)** for URL-fetching endpoints. The mitigations don't change; just the top-level numbering.
+
+## Beyond OWASP Top-10 — Common Bonus Risks
+
+- **SSRF** (now under A06): allowlist target hosts; block private IP ranges; re-resolve DNS; short timeouts. See [references/owasp-top-10.md](references/owasp-top-10.md) section A06 for full code.
+- **CSRF** (cookie-auth web only): SameSite=Strict + double-submit token / custom header.
+- **XXE**: defusedxml (Python); Go encoding/xml safe by default.
+- **SSTI**: parameter binding only, never string-concat user input into templates.
+- **Mass assignment**: explicit DTOs at the boundary; never `model.update(**body)`.
+- **Path traversal**: `Path.resolve().is_relative_to(base)` check on every user-supplied path.
+- **Open redirect**: allowlist destinations on `?return_to=` and OAuth callback URLs.
+
+## Security Headers — JSON API Defaults
+
+```
+Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
+X-Content-Type-Options:    nosniff
+X-Frame-Options:           DENY
+Referrer-Policy:           strict-origin-when-cross-origin
+Permissions-Policy:        camera=(), microphone=(), geolocation=(), interest-cohort=()
+Content-Security-Policy:   default-src 'none'; frame-ancestors 'none'
+Cross-Origin-Opener-Policy:   same-origin
+Cross-Origin-Resource-Policy: same-site
+```
+
+For HTML pages, replace CSP with a per-page policy using nonces (NOT `unsafe-inline`).
+
+Set as middleware that runs on every response. Don't trust devs to remember per-route.
+
+## CORS — Default Deny
+
+```go
+import "github.com/gofiber/fiber/v3/middleware/cors"
+
+app.Use(cors.New(cors.Config{
+    AllowOrigins:     []string{"https://app.com", "https://admin.app.com"},
+    AllowCredentials: true,
+    AllowMethods:     []string{"GET", "POST", "PATCH", "DELETE"},
+    AllowHeaders:     []string{"Authorization", "Content-Type", "Idempotency-Key"},
+    MaxAge:           600,
+}))
+```
+
+NEVER `AllowOrigins: ["*"]` with `AllowCredentials: true`. The browser refuses, but the misconfig is a smell.
+
+## Secrets Management
+
+- **NEVER** in source code, Dockerfiles, env vars committed to repos.
+- **Use a secrets manager**: AWS Secrets Manager / GCP Secret Manager / HashiCorp Vault / 1Password Connect.
+- **App fetches secrets at startup** (or via short-lived token from secrets manager).
+- **Rotate**: quarterly + immediately on any access by someone who shouldn't have it.
+- **Audit access logs** of the secrets manager.
+- **Don't proliferate** — one secret per purpose, no "shared utility token".
+
+```python
+async def lifespan(app):
+    config = await load_config_with_secrets()  # at startup, not import-time
+    app.state.config = config
+    yield
+```
+
+## Supply-Chain Hardening
+
+For the layered defense (lockfiles → vulnerability scanning → dep review → minimization → confusion defense → provenance/sigstore → CI hardening → runtime detection → SBOM), see [references/supply-chain.md](references/supply-chain.md).
+
+Mandatory minimum:
+
+- All lockfiles committed.
+- CI runs `osv-scanner --recursive .` — fails on high.
+- GitHub Actions pinned to commit SHA, not tag.
+- Short-lived OIDC tokens for cloud auth.
+- SBOM per release (CycloneDX or SPDX).
+
+## Dependency Vulnerability Process
+
+```bash
+# Go
+govulncheck ./...
+
+# Python
+pip-audit                # PyPI vulnerabilities
+# OR
+safety check
+
+# Node
+yarn npm audit --severity high --recursive
+
+# Cross-platform (preferred — single tool, all ecosystems via OSV database)
+osv-scanner --recursive .
+```
+
+CI: fail the build on `severity >= high`. Ignore via explicit allowlist with expiration date.
+
+## Incident Response
+
+- **Logs centralized** + retained 90+ days.
+- **Runbook** for "user reports account takeover" / "leaked secret detected" / "PII data leak suspected".
+- **Disclosure channel** (`security@app.com`) with 48-hour SLA.
+- **Rotate** affected secrets immediately on detection.
+- **Notify** affected users per regulatory requirements (GDPR: 72h to authority; CPRA: prompt user notice).
+
+## A10:2025 Mishandling of Exceptional Conditions — The New One
+
+NEW in 2025. Most teams have never explicitly defended against this category. Three failure modes:
+
+1. **Resource leaks** on exception → file uploads don't close handles, eventually OOM the process.
+2. **Information leak** in error responses → DB error message exposes table names → SQLi reconnaissance.
+3. **Partial commits** on transaction failure → attacker exploits the half-applied state (drained accounts, duplicate transfers).
+
+**Defenses**:
+
+- **Catch at source, not at the top-level handler.** A 200-line `try/except Exception` in the route is a smell.
+- **`with` / `defer` / `finally` for ALL resource acquisition** — file handles, DB connections, locks, GPU/ML buffers.
+- **Atomic transaction OR full rollback** — `UnitOfWork.run(...)` per `hexagonal-architecture` skill. Never partial commit.
+- **Centralized error envelope** — RFC 9457 (per `api-design`) — DON'T construct error JSON ad-hoc per route.
+- **Fail-closed in security-relevant code**: if auth check throws, return 401 — never default to "allow because exception".
+- **Resource quotas** at the framework: max body size, max upload count, max concurrent connections per user.
+- **Test the unhappy path**: pytest fixtures that throw mid-transaction, mid-stream, mid-write — assert state stays clean.
+
+```python
+# BAD — leaks file handle on exception, leaks SQL detail on response
+@app.post("/upload")
+async def upload(file: UploadFile):
+    f = open("/var/uploads/" + file.filename, "wb")
+    while chunk := await file.read(1 << 16):
+        f.write(chunk)
+    await db.execute("INSERT INTO files (path) VALUES ($1)", file.filename)
+    f.close()
+
+# GOOD — context-managed file, validated path, generic error
+@app.post("/upload")
+async def upload(file: UploadFile):
+    safe = safe_upload_path(file.filename)        # raises on traversal
+    try:
+        async with aiofiles.open(safe, "wb") as f:
+            while chunk := await file.read(1 << 16):
+                await f.write(chunk)
+        await db.execute("INSERT INTO files (path) VALUES ($1)", safe.name)
+    except DBError as exc:
+        logger.error("file insert failed", extra={"path_hash": h(safe), "exc": str(exc)})
+        await aiofiles.os.remove(safe)            # rollback the side effect
+        raise HTTPException(500, detail="upload failed") from exc
+```
+
+## Common Backend-Security Mistakes
+
+1. **Trusting client-side data** — client is hostile by default.
+2. **No input validation** — every external string is potentially malicious.
+3. **String interpolation in SQL** — SQLi waiting to happen.
+4. **`eval` / `exec` / dynamic code** — almost never the right answer.
+5. **Sensitive data in logs / error responses** — incident waiting to happen.
+6. **Rate limit per IP only** — IPv6 makes this useless; rate limit per user too.
+7. **No CSRF defense on cookie auth** — drive-by sites take action as the user.
+8. **CORS `*` with credentials** — browser blocks, but the intent leaked.
+9. **Long-lived secrets in env vars** — first leak forever.
+10. **No security headers** — XSS / clickjacking / MIME-sniffing trivial.
+11. **Outdated dependencies** — known CVEs unfixed for months.
+12. **No SSRF protection** on URL-fetching endpoints.
+13. **Mass assignment** without DTO — privilege escalation via crafted body.
+14. **Path traversal** in upload / download endpoints.
+15. **Open redirect** in OAuth callback / login flow.
+
+## Pre-Production Checklist
+
+See [assets/security-web-checklist.md](assets/security-web-checklist.md) — gate runs through every category with concrete checks. Unchecked items block release.
+
+## Source Material
+
+- *OWASP Top-10 (2025)*: <https://owasp.org/Top10/2025/> (released November 2025; current standard).
+- *OWASP API Security Top-10 (2023)*: <https://owasp.org/API-Security/> (separate list specifically for APIs).
+- *OWASP ASVS v5.0* (Application Security Verification Standard, 2024+).
+- *OWASP Cheat Sheet Series*: <https://cheatsheetseries.owasp.org/>
+- *NIST SP 800-218* — Secure Software Development Framework.
+- *NIST SP 800-61* — Computer Security Incident Handling Guide (for A09 alerting / runbooks).
+- *PortSwigger Web Security Academy* — best free training.
+- *CISA Known Exploited Vulnerabilities catalog* — for prioritizing patch work.

core/skills/security-web/assets/security-web-checklist.md

@@ -0,0 +1,167 @@
+# Server-Side Security Pre-Production Checklist (OWASP Top-10 2025)
+
+Run before promoting a backend service to production traffic. Each item is a concrete check; uncheck → block release.
+
+Sections in 2025 ranking order.
+
+## Broken Access Control (A01:2025) — still #1
+
+- [ ] Every endpoint requires explicit auth check.
+- [ ] Role/scope validated server-side, never trusted from client.
+- [ ] Use cases assert resource ownership (or admin) before mutating.
+- [ ] Multi-tenant: tenant_id filter in every query OR Postgres RLS active.
+- [ ] IDOR test: enumerate IDs as user A, verify all reads/writes for user B return 403/404.
+- [ ] Admin endpoints behind separate auth + IP allowlist.
+
+## Security Misconfiguration (A02:2025) — ↑ from #5
+
+- [ ] Security headers set on every response (HSTS, CSP, COOP, CORP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options).
+- [ ] CORS allowlist; no `*` with credentials.
+- [ ] No `DEBUG=True` in production.
+- [ ] Stack traces never returned to clients.
+- [ ] Default admin paths (`/admin`, `/swagger`) gated by auth + IP allowlist.
+- [ ] Container: minimal base image, non-root user, read-only FS, dropped capabilities (`--cap-drop=ALL`).
+- [ ] Kubernetes `securityContext`: `runAsNonRoot: true`, `readOnlyRootFilesystem: true`.
+- [ ] Cloud IAM: principle of least privilege; no wildcard policies.
+- [ ] No leftover dev tools / debug endpoints / test data in production.
+
+## Software Supply Chain Failures (A03:2025) — renamed + expanded; ↑ from #6
+
+- [ ] All lockfiles committed (`go.sum`, `uv.lock`, `yarn.lock`, etc.). CI uses `--frozen-lockfile`.
+- [ ] CI runs `osv-scanner --recursive .` (cross-ecosystem) — fails on high.
+- [ ] Plus per-ecosystem: `govulncheck` / `pip-audit` / `yarn npm audit`.
+- [ ] No deps unpatched > 30 days for high-severity CVEs.
+- [ ] No abandoned deps (last commit > 2 years).
+- [ ] Dependency PRs reviewed (Dependabot / Renovate not auto-merged blindly).
+- [ ] SBOM generated per release (CycloneDX or SPDX); attached to GitHub release.
+- [ ] **GitHub Actions pinned to commit SHA, not tag** (e.g., `actions/checkout@8e5e7e5...`).
+- [ ] **Short-lived OIDC tokens** for cloud auth in CI (no long-lived AWS/GCP keys in env).
+- [ ] **MFA + IAM lockdown** on registry accounts (npm, PyPI, Docker Hub, Releases).
+- [ ] **Separation of duties**: no single person writes code AND promotes to prod.
+- [ ] **Two-person rule** for high-impact package publishes.
+- [ ] Components only from official registries over HTTPS; no `curl | sh`.
+- [ ] Private packages: scoped (`@app/*`) + private registry first in `.npmrc`.
+- [ ] Container images scanned (Trivy/Grype) on every build.
+- [ ] Staged rollouts (canary + automated rollback) for vendor-update consumption.
+
+## Cryptographic Failures (A04:2025) — ↓ from #2
+
+- [ ] TLS 1.2+ everywhere (TLS 1.3 preferred). HSTS header set.
+- [ ] No mixed content (HTTP assets on HTTPS pages).
+- [ ] PII encrypted at rest where applicable (KMS-encrypted columns / SQLCipher).
+- [ ] Passwords hashed with Argon2id (≥250ms / hash on prod hardware).
+- [ ] Refresh tokens stored as SHA-256 hash, not plain.
+- [ ] No deprecated crypto (MD5, SHA-1, RC4, DES, 3DES, AES-ECB, RSA-1024).
+- [ ] AEAD ciphers only (AES-GCM or ChaCha20-Poly1305).
+- [ ] `crypto/rand` (Go) / `secrets` (Python) for any token generation.
+
+## Injection (A05:2025) — ↓ from #3
+
+- [ ] All SQL via parameterized queries / prepared statements / sqlc.
+- [ ] All NoSQL via parameterized API; no string interpolation; no `$where` with user input.
+- [ ] No `os.system` / `exec.Command(shell)` with user input concatenated.
+- [ ] All XML parsing via `defusedxml` or equivalent (XXE off).
+- [ ] All template rendering uses parameter binding, not string concat.
+- [ ] Mass assignment blocked: explicit DTO at the boundary.
+- [ ] GraphQL: depth + complexity limits set; field-level authz.
+- [ ] **LLM prompt injection**: user input never substituted into system prompt; structured roles (system/user/assistant); output filtered for sensitive patterns.
+
+## Insecure Design (A06:2025) — ↓ from #4 (now also covers SSRF)
+
+- [ ] Server-authoritative checks for prices, quantities, totals, role flags.
+- [ ] Idempotency keys on all mutations.
+- [ ] Rate limiting on auth + sensitive endpoints (per-user AND per-IP).
+- [ ] Failure modes for cache miss, DB timeout, third-party failure planned + tested.
+- [ ] Privacy: collect minimum data, retain minimum time, delete on request.
+- [ ] Threat model documented for new features.
+- [ ] **SSRF** (was A10:2021, now under here): URL-fetching endpoints validate target host, block private IPs (10/8, 172.16/12, 192.168/16, 127/8, 169.254/16, fc00::/7, cloud metadata 169.254.169.254), re-resolve DNS, short timeouts (5s).
+
+## Authentication Failures (A07:2025) — renamed (was "Identification & Authentication")
+
+(Refer to `auth-patterns` checklist when present — full auth audit.)
+
+- [ ] Passwords with Argon2id, no enumeration on login / reset.
+- [ ] Rate-limit login (per-user + per-IP).
+- [ ] Refresh-token rotation with theft detection.
+- [ ] Session cookies: Secure + HttpOnly + SameSite.
+- [ ] OAuth uses 2.1 + PKCE.
+- [ ] Passkeys / WebAuthn offered where possible (preferred default 2026).
+
+## Software or Data Integrity Failures (A08:2025) — same
+
+- [ ] No insecure deserialization (`pickle`, native serialization) of untrusted data.
+- [ ] CI/CD uses short-lived tokens (OIDC) — no long-lived secrets in env.
+- [ ] GitHub Actions pinned to commit SHA, not tag.
+- [ ] Code-signing verified for app artifacts.
+- [ ] Webhooks: HMAC signature verification on every incoming call.
+- [ ] No `eval` anywhere.
+
+## Security Logging and Alerting Failures (A09:2025) — renamed (Monitoring → Alerting)
+
+- [ ] Auth events logged with `request_id`, `user_id`, `event_type`.
+- [ ] Authorization denials logged.
+- [ ] No tokens / passwords / 2FA codes / full PII in logs (CWE-532).
+- [ ] Sensitive headers (Authorization, Cookie) scrubbed in framework logs + APM.
+- [ ] **Alerts** configured (the 2025 emphasis): auth-failure spikes, 403-spike, rate-limit triggers, outbound-traffic anomaly, new CVE matches your SBOM.
+- [ ] **Each alert has a runbook** — page-without-runbook = alarm fatigue.
+- [ ] Incident-response framework adopted (NIST 800-61 or equivalent).
+- [ ] Log retention ≥ 90 days for security events.
+
+## Mishandling of Exceptional Conditions (A10:2025) — NEW
+
+- [ ] **Catch at source**, not just at top-level handler.
+- [ ] **Resource cleanup** in `with` / `defer` / `finally` for ALL handles (file, DB, lock, GPU buffer).
+- [ ] **Atomic transactions** — `UnitOfWork.run(...)` per `hexagonal-architecture`; no partial commit.
+- [ ] **Fail-closed** in security code (auth check exception → deny, not allow).
+- [ ] **Centralized error envelope** (RFC 9457 ProblemDetails per `api-design`); never construct error JSON ad-hoc per route.
+- [ ] **No `str(exc)` in client-facing detail** (CWE-209: information leak).
+- [ ] **Resource quotas** at framework: max body, max upload count, max concurrent connections, max LLM context tokens.
+- [ ] **Unhappy-path tests**: pytest fixtures that throw mid-transaction / mid-stream / mid-write — assert state stays clean.
+- [ ] **Global exception handler** as a safety net (sanitized response + full log + alert).
+
+## CSRF (cookie-auth web clients only)
+
+- [ ] `SameSite=Strict` (or `Lax` justified) on session cookies.
+- [ ] Double-submit token OR custom-header check on state-changing endpoints.
+- [ ] Origin/Referer validation on POST.
+
+## Path Traversal / Open Redirect
+
+- [ ] No user input concatenated into filesystem paths without `is_relative_to(base)` check.
+- [ ] Open-redirect endpoints (`?return_to=`) restricted to allowlist (relative paths or specific hosts).
+- [ ] OAuth callback `redirect_uri` allowlist enforced server-side.
+
+## Secrets Management
+
+- [ ] No secrets in source code, lockfiles, Dockerfiles, config files in repo.
+- [ ] Secrets manager (AWS / GCP / Vault) used; app fetches at startup.
+- [ ] Secrets rotated quarterly + on suspected leak.
+- [ ] Access to secrets audited.
+- [ ] No "shared utility token" — one secret per purpose.
+
+## Network
+
+- [ ] Outbound-traffic allowlist at network layer (egress firewall).
+- [ ] Database not internet-reachable (private VPC).
+- [ ] Internal services use mTLS or service-mesh equivalent.
+
+## Operational
+
+- [ ] Incident runbook documented (account takeover, leaked secret, suspected breach).
+- [ ] `security@app.com` mailbox monitored; SLA documented.
+- [ ] Pentest within last 12 months OR scoped engagement queued.
+- [ ] On-call playbook covers security incidents (not just availability).
+
+## Pre-Production Verification
+
+- [ ] **OWASP ZAP** baseline scan against staging — no high.
+- [ ] **`osv-scanner` recursive** — zero high.
+- [ ] **`govulncheck ./...`** — clean.
+- [ ] **Manual auth bypass attempt** — try to access endpoints without auth, with wrong scope, with expired token.
+- [ ] **mitmproxy capture** of typical traffic — verify no PII in URLs, no tokens in logs, headers correct.
+- [ ] **Dependency review** of any new direct deps in this release.
+- [ ] **SBOM diff** vs previous release — flag major dependency changes.
+
+---
+
+Unchecked items block release. Document waivers in a tracking issue with an ETA.