mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-15 13:36:35 +03:00
Magnus HedemarkandGitHub
c7c4d3b74f
Engineering: backend-engineering, frontend-engineering, data-engineering, ml-engineering, platform-engineering, qa-methodology Executive: go-to-market, legal-strategy, operational-design, org-design, product-strategy ml-engineering: added missing training-infrastructure.md reference qa-methodology: added test-data-management, performance-testing, security-testing references All frontmatter converted to agent-skills convention. Source: https://github.com/magnus919/hermes-profiles
70 lines
3.1 KiB
Markdown
70 lines
3.1 KiB
Markdown
# Security Testing
|
|
|
|
## Test Types by Phase
|
|
|
|
| Phase | Test Type | Tool | Frequency |
|
|
|-------|-----------|------|-----------|
|
|
| Pre-commit | Secret scanning | gitleaks, trufflehog | Every commit |
|
|
| CI | SAST (static analysis) | Semgrep, CodeQL, bandit (Python), eslint-security | Every PR |
|
|
| CI | Dependency audit | `npm audit`, `pip-audit`, Dependabot, Snyk | Every PR + daily |
|
|
| CI | Container scanning | Trivy, Grype | Every image build |
|
|
| Staging | DAST (dynamic) | OWASP ZAP, Burp Suite | Nightly or pre-release |
|
|
| Staging | API fuzzing | Schemathesis (OpenAPI), RESTler | Weekly |
|
|
| Pre-release | Pen test (manual) | External firm or red team | Quarterly / major release |
|
|
|
|
## OWASP Top 10 — Test Patterns
|
|
|
|
| Risk | What to Test | How |
|
|
|------|-------------|-----|
|
|
| Injection (SQL, command, LDAP) | All user input reaches DB/shell | Parameterized query audit; fuzz with `' OR 1=1`, `; rm -rf` |
|
|
| Broken auth | Session fixation, token expiry, brute force | Attempt reuse of expired tokens; test rate limiting |
|
|
| Sensitive data exposure | PII in logs, unencrypted transit | Grep logs for email/SSN patterns; verify TLS everywhere |
|
|
| XXE | XML parsers accept external entities | Send `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` |
|
|
| Broken access control | IDOR, privilege escalation | Access other users' resources by ID; test admin endpoints as regular user |
|
|
| Security misconfiguration | Default creds, verbose errors, open ports | Banner grab; check `/debug`, `/admin`, `.env` exposure |
|
|
| XSS | Reflected/stored/DOM | Inject `<script>alert(1)</script>` in every input field |
|
|
| Insecure deserialization | Pickle, YAML.load, Java ObjectInputStream | Audit all `loads()`/`unserialize()` calls for untrusted input |
|
|
| Known vulnerabilities | CVEs in dependencies | `pip-audit`, `npm audit`, Trivy |
|
|
| SSRF | Server fetches user-supplied URLs | Provide `http://169.254.169.254/` (cloud metadata), `http://localhost:6379` |
|
|
|
|
## SAST in CI (Semgrep Example)
|
|
|
|
```yaml
|
|
# .github/workflows/security.yml
|
|
- name: Semgrep
|
|
uses: semgrep/semgrep-action@v1
|
|
with:
|
|
config: >-
|
|
p/owasp-top-ten
|
|
p/python
|
|
p/security-audit
|
|
```
|
|
|
|
## Dependency Audit Discipline
|
|
|
|
- Block merges on **critical** and **high** severity findings
|
|
- **Medium**: create issue, fix within sprint
|
|
- **Low**: batch into maintenance window
|
|
- Pin transitive deps with lockfiles (`package-lock.json`, `uv.lock`, `Gemfile.lock`)
|
|
- Review Dependabot PRs weekly — don't let them accumulate
|
|
|
|
## Container Security
|
|
|
|
```bash
|
|
# Scan image for OS + language CVEs
|
|
trivy image --severity HIGH,CRITICAL myapp:latest
|
|
|
|
# Fail CI on critical findings
|
|
trivy image --exit-code 1 --severity CRITICAL myapp:latest
|
|
```
|
|
|
|
- Use distroless or alpine base images (smaller attack surface)
|
|
- Run as non-root (`USER 1000` in Dockerfile)
|
|
- No secrets in image layers — use runtime injection (Vault, SSM, k8s secrets)
|
|
|
|
## Security Test Data
|
|
|
|
- Never test with real PII — use synthetic data (see test-data-management.md)
|
|
- Credential testing uses obviously-fake values: `AKIAIOSFODNN7EXAMPLE`
|
|
- If a test discovers a real vulnerability, stop and report — don't commit exploit code
|