magnus919_agent-skills/qa-methodology/references/security-testing.md

Security Testing

Test Types by Phase

Phase	Test Type	Tool	Frequency
Pre-commit	Secret scanning	gitleaks, trufflehog	Every commit
CI	SAST (static analysis)	Semgrep, CodeQL, bandit (Python), eslint-security	Every PR
CI	Dependency audit	npm audit, pip-audit, Dependabot, Snyk	Every PR + daily
CI	Container scanning	Trivy, Grype	Every image build
Staging	DAST (dynamic)	OWASP ZAP, Burp Suite	Nightly or pre-release
Staging	API fuzzing	Schemathesis (OpenAPI), RESTler	Weekly
Pre-release	Pen test (manual)	External firm or red team	Quarterly / major release

OWASP Top 10 — Test Patterns

Risk	What to Test	How
Injection (SQL, command, LDAP)	All user input reaches DB/shell	Parameterized query audit; fuzz with ' OR 1=1, ; rm -rf
Broken auth	Session fixation, token expiry, brute force	Attempt reuse of expired tokens; test rate limiting
Sensitive data exposure	PII in logs, unencrypted transit	Grep logs for email/SSN patterns; verify TLS everywhere
XXE	XML parsers accept external entities	Send <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
Broken access control	IDOR, privilege escalation	Access other users' resources by ID; test admin endpoints as regular user
Security misconfiguration	Default creds, verbose errors, open ports	Banner grab; check /debug, /admin, .env exposure
XSS	Reflected/stored/DOM	Inject <script>alert(1)</script> in every input field
Insecure deserialization	Pickle, YAML.load, Java ObjectInputStream	Audit all loads()/unserialize() calls for untrusted input
Known vulnerabilities	CVEs in dependencies	pip-audit, npm audit, Trivy
SSRF	Server fetches user-supplied URLs	Provide http://169.254.169.254/ (cloud metadata), http://localhost:6379

SAST in CI (Semgrep Example)

# .github/workflows/security.yml
- name: Semgrep
  uses: semgrep/semgrep-action@v1
  with:
    config: >-
      p/owasp-top-ten
      p/python
      p/security-audit

Dependency Audit Discipline

• Block merges on critical and high severity findings
• Medium: create issue, fix within sprint
• Low: batch into maintenance window
• Pin transitive deps with lockfiles (package-lock.json, uv.lock, Gemfile.lock)
• Review Dependabot PRs weekly — don't let them accumulate

Container Security

# Scan image for OS + language CVEs
trivy image --severity HIGH,CRITICAL myapp:latest

# Fail CI on critical findings
trivy image --exit-code 1 --severity CRITICAL myapp:latest

• Use distroless or alpine base images (smaller attack surface)
• Run as non-root (USER 1000 in Dockerfile)
• No secrets in image layers — use runtime injection (Vault, SSM, k8s secrets)

Security Test Data

• Never test with real PII — use synthetic data (see test-data-management.md)
• Credential testing uses obviously-fake values: AKIAIOSFODNN7EXAMPLE
• If a test discovers a real vulnerability, stop and report — don't commit exploit code