2.4 KiB
2.4 KiB
name, description, scope
| name | description | scope |
|---|---|---|
| app-security | Harden affected application boundaries when implementing or auditing authorization, uploads, user-influenced outbound requests, or sensitive data handling. | global |
Application security
Inspect the affected boundary and existing controls. Apply the protections relevant to the task; a small fix does not require a full application audit.
- Validate untrusted payloads with runtime schemas and resource bounds derived from product requirements. Reject invalid data; do not silently truncate credentials.
- Derive identity from verified server authentication. Enforce tenant/resource permissions on private reads and writes, preferably within the data operation. Cover unauthenticated access, cross-tenant access, and relevant races.
- For uploads, enforce a product-specific extension/type allowlist, stream byte limits, and appropriate content validation. Magic headers alone do not prove safety. Use generated storage names and an isolated non-executable root; prevent traversal and symlink escapes. Serve potentially active content with appropriate isolation and headers. Bound archive expansion or decoding work when applicable.
- For user-influenced outbound destinations, allowlist known services where possible. Parse URLs, restrict schemes, resolve and validate all IPv4/IPv6 addresses, and prevent DNS changes from bypassing connection checks. Disable redirects or validate each destination using the same policy. Block private, loopback, link-local, unspecified, and metadata targets unless a specific trusted internal service is intentionally allowed. Apply time, response-size, and network egress limits.
- Redact credentials at logging/telemetry boundaries and keep public errors free of secrets and internal traces. Apply relevant session, CSRF, rate-limiting, and browser content controls using existing framework facilities.
- Verify the changed boundary with meaningful negative cases under shared verification. Report actual protections and gaps; do not claim the whole app is secure from a checklist.
Use the playbook for implementation choices and the checklist for an explicitly requested audit. Local fixtures need deliberate configuration, not an automatic security bypass.