feat(hub-guide): expand plugin with 26 best-practice skills, hooks, and references
Transform hub-guide from a single-skill Hub monorepo guide into a comprehensive programming best-practice plugin covering all situations. Skills (26): - Core: engineering-principles, clean-code, clean-architecture, design-patterns, testing, error-handling, security, api-design, git-workflow, documentation, logging-observability, performance - Languages: typescript, python, rust, go - Frameworks: react-frontend, elysiajs, hono-backend, drizzle-database, nextjs - Infrastructure: docker, ci-cd, monitoring - Monorepo: monorepo, hub-guide (existing) Hooks: - SessionStart: auto-detect project type and activate relevant skills - PreToolUse (Write|Edit): inject language-specific rules per file type Reference files for deep dives: - clean-architecture/references/solid.md (SOLID + component principles) - design-patterns/references/catalog.md (full GoF catalog with examples) - testing/references/mocks.md (test double taxonomy) Restructure plugin to modern skills/ directory format.
This commit is contained in:
asepharyana
@@ -0,0 +1,129 @@
|
||||
---
|
||||
name: security
|
||||
description: Security best practices for software development — input validation, authentication, authorization, secrets management, OWASP Top 10, and secure coding patterns. Use when handling user input, designing auth flows, storing secrets, configuring CORS/headers, or whenever the user mentions "security," "XSS," "SQL injection," "CSRF," "authentication," "authorization," "JWT," "OAuth," "encryption," "secrets," "CORS," "RBAC," "OWASP," or "security review."
|
||||
---
|
||||
|
||||
# Security Best Practices
|
||||
|
||||
## OWASP Top 10 (Quick Reference)
|
||||
|
||||
1. **Broken Access Control** — verify authorization for every action, not just login.
|
||||
2. **Cryptographic Failures** — use modern crypto (AES-256-GCM, bcrypt/Argon2 for passwords, TLS 1.3).
|
||||
3. **Injection** — never concatenate user input into SQL/shell/HTML. Use parameterized queries.
|
||||
4. **Insecure Design** — threat model before building. Rate limit, throttle, validate.
|
||||
5. **Security Misconfiguration** — remove defaults, disable debug in prod, use secure headers.
|
||||
6. **Vulnerable Components** — keep dependencies updated. Use SCA tools (Dependabot, Renovate).
|
||||
7. **Auth Failures** — MFA, rate-limit login, no weak passwords, secure session management.
|
||||
8. **Data Integrity Failures** — signed JWTs, integrity checks on CI/CD pipeline.
|
||||
9. **Logging Failures** — log auth failures, never log secrets, monitor suspicious patterns.
|
||||
10. **SSRF** — validate URLs, restrict outbound network access.
|
||||
|
||||
## Input Validation (First Line of Defense)
|
||||
|
||||
- **Whitelist > blacklist** — define what's allowed, not what's blocked.
|
||||
- **Validate at every trust boundary** — API gateway → service → use case.
|
||||
- **Type coercion** — parse, cast, then use. Never trust raw strings.
|
||||
- **Size limits** — enforce max lengths, max file sizes.
|
||||
- **Content types** — validate `Content-Type` and reject unexpected formats.
|
||||
|
||||
## Authentication
|
||||
|
||||
- **Passwords:** bcrypt (cost ≥10), Argon2id, or PBKDF2. Never MD5/SHA1.
|
||||
- **JWTs:** Use `jose`/`jsonwebtoken` with RS256 or ES256. Short TTL (15min access, 7d refresh max). Validate `aud`, `iss`, `exp`, `nbf`.
|
||||
- **Sessions:** HttpOnly, Secure, SameSite=Strict cookies. Rotate on privilege change.
|
||||
- **MFA:** Prefer TOTP/WebAuthn over SMS (SIM swap risk).
|
||||
- **Rate limiting:** Login/registration/password-reset endpoints. 5 attempts/15min per IP is standard.
|
||||
|
||||
## Authorization
|
||||
|
||||
- **RBAC** — roles assigned to users, permissions assigned to roles.
|
||||
- **ABAC** (attribute-based) — for fine-grained: resource owner, department, region.
|
||||
- **Check every request** — authorization at every endpoint, not just at login.
|
||||
- **Default deny** — fail closed. If no rule allows it, deny it.
|
||||
- **Middleware pattern:**
|
||||
```typescript
|
||||
// Authenticate → Authorize → Execute
|
||||
app.use('/api/*', authenticate);
|
||||
app.use('/api/admin/*', authorize('admin'));
|
||||
app.post('/api/orders', authorizeOrderAccess);
|
||||
```
|
||||
|
||||
## Secrets Management
|
||||
|
||||
- **Never commit secrets.** Use environment variables or a vault (Vault, AWS Secrets Manager, 1Password CLI).
|
||||
- **.env files** — never committed to git. Use `.env.example` as a template.
|
||||
- **Scan for secrets** — use `trufflehog`, `git-secrets`, or GitHub secret scanning.
|
||||
- **Rotate regularly** — API keys, DB passwords, JWT signing keys.
|
||||
- **Principle of least privilege** — tokens/secrets should have minimal scope.
|
||||
|
||||
## API Security
|
||||
|
||||
### Headers (via Traefik or middleware)
|
||||
```yaml
|
||||
# Traefik example
|
||||
middleware:
|
||||
secure-headers:
|
||||
headers:
|
||||
frameDeny: true
|
||||
contentTypeNosniff: true
|
||||
browserXssFilter: true
|
||||
sslRedirect: true
|
||||
referrerPolicy: "no-referrer-when-downgrade"
|
||||
permissionsPolicy: "camera=(), microphone=(), geolocation=()"
|
||||
customFrameOptionsValue: "SAMEORIGIN"
|
||||
contentSecurityPolicy: "default-src 'self'; script-src 'self'"
|
||||
```
|
||||
|
||||
### CORS
|
||||
- **Default:** same-origin only.
|
||||
- **For APIs:** whitelist specific origins, never `Access-Control-Allow-Origin: *` for authenticated endpoints.
|
||||
- **Credentials:** `Access-Control-Allow-Credentials: true` only with explicit origin.
|
||||
|
||||
### Rate Limiting
|
||||
- **Per IP, per user, per endpoint.** Different limits for different tiers.
|
||||
- **Return `429 Too Many Requests`** with `Retry-After` header.
|
||||
- **Log rate limit hits** — they often precede attacks.
|
||||
|
||||
## Data Protection
|
||||
|
||||
- **Encrypt at rest** — AES-256-GCM for PII. Transparent encryption or app-level.
|
||||
- **Encrypt in transit** — TLS 1.3 minimum. HSTS with `max-age=63072000`.
|
||||
- **PII minimization** — don't collect what you don't need. Anonymize when possible.
|
||||
- **Data retention** — delete old data. Have a purge policy.
|
||||
- **SQL injection prevention:**
|
||||
```typescript
|
||||
// ❌ Never
|
||||
db.execute(`SELECT * FROM users WHERE id = '${id}'`);
|
||||
// ✅ Always
|
||||
db.execute('SELECT * FROM users WHERE id = $1', [id]);
|
||||
```
|
||||
|
||||
## XSS Prevention
|
||||
|
||||
- **React/Vue/Svelte/Solid** — auto-escaped by default. Avoid `dangerouslySetInnerHTML`/`v-html`.
|
||||
- **CSP headers** — `Content-Security-Policy` restricts script sources.
|
||||
- **Never eval user input** — `JSON.parse` is safe, `eval` is not.
|
||||
- **Sanitize HTML** — use DOMPurify if you must render user HTML.
|
||||
|
||||
## CSRF Prevention
|
||||
|
||||
- **SameSite cookies** — `SameSite=Strict`/`Lax` covers most cases.
|
||||
- **CSRF tokens** — for forms without SameSite support.
|
||||
- **Custom headers** — `X-Requested-By` is a valid CSRF token pattern for APIs.
|
||||
|
||||
## Dependency Security
|
||||
|
||||
- **Regular audits** — `npm audit`, `cargo audit`, `pip-audit`.
|
||||
- **Lock files** — commit `package-lock.json`, `Cargo.lock`, `poetry.lock`.
|
||||
- **Dependabot/Renovate** — automate dependency updates.
|
||||
- **No `*` ranges** — pin major/minor, allow patches.
|
||||
- **SBOM** — generate Software Bill of Materials for production deployments.
|
||||
|
||||
## Language-Specific
|
||||
|
||||
| Language | Key Practice |
|
||||
|----------|-------------|
|
||||
| TypeScript | `strict: true`, no `any`, use `jose` for JWT |
|
||||
| Python | Use `httpx`/`requests` with TLS verify. Pydantic for validation |
|
||||
| Rust | `cargo audit`, `ring` for crypto, parameterized queries via sqlx |
|
||||
| Go | `crypto` stdlib, parameterized with `database/sql`, govulncheck |
|
||||
Reference in New Issue
Block a user