security-practices
Master secure development, OWASP top 10, testing, and compliance. Use when building secure systems, conducting security reviews, or implementing best practices.
When & Why to Use This Skill
The Security, QA & Best Practices skill is a comprehensive resource designed to fortify software development lifecycles. It provides actionable guidance on implementing secure authentication, mitigating OWASP Top 10 vulnerabilities, and ensuring industry-standard compliance (GDPR, HIPAA, PCI-DSS). By integrating advanced security tools like Burp Suite and OWASP ZAP with robust testing frameworks, this skill helps developers build resilient, high-quality systems that prioritize data integrity and user safety.
Use Cases
- Secure Authentication Implementation: Utilizing Bcrypt for password hashing and JWT for secure token-based authorization in web applications.
- Vulnerability Assessment: Conducting security reviews and implementing defenses against common threats like SQL injection and Cross-Site Scripting (XSS) based on OWASP guidelines.
- Regulatory Compliance: Aligning software architecture and data handling procedures with legal requirements such as GDPR, HIPAA, and PCI-DSS.
- Automated Security Testing: Integrating security scanning and code quality checks into CI/CD pipelines using tools like SonarQube, ESLint, and OWASP ZAP.
- Quality Assurance & Testing: Developing comprehensive unit, integration, and E2E testing suites using Jest, Cypress, or Selenium to ensure software reliability.
| name | security-practices |
|---|---|
| description | Master secure development, OWASP top 10, testing, and compliance. Use when building secure systems, conducting security reviews, or implementing best practices. |
| sasmp_version | "1.3.0" |
| bonded_agent | 06-security-qa-practices |
| bond_type | PRIMARY_BOND |
Security, QA & Best Practices Skill
Quick Start - Secure Authentication
import bcrypt from 'bcrypt';
import jwt from 'jsonwebtoken';
// Hash password
const password = 'user_password';
const hash = await bcrypt.hash(password, 10);
// Verify password
const isValid = await bcrypt.compare(password, hash);
// Issue JWT
const token = jwt.sign(
{ userId: 1, email: 'user@example.com' },
process.env.JWT_SECRET,
{ expiresIn: '24h', algorithm: 'HS256' }
);
// Verify JWT
const decoded = jwt.verify(token, process.env.JWT_SECRET);
Core Technologies
Security Tools
- Burp Suite
- OWASP ZAP
- Snort/Suricata
- Nmap
Testing Frameworks
- Selenium / Cypress
- Jest / pytest
- JMeter / Gatling
- Postman / Insomnia
Code Quality
- SonarQube
- ESLint / Prettier
- Pylint / Black
Best Practices
- OWASP Top 10 - Know and prevent vulnerabilities
- Secure Coding - Input validation, parameterized queries
- Testing - Unit, integration, and E2E tests
- Code Review - Peer review process
- Monitoring - Continuous security monitoring
- Compliance - GDPR, HIPAA, PCI-DSS
- Incident Response - Clear procedures
- Documentation - Security policies