39 lines
2.4 KiB
Markdown
39 lines
2.4 KiB
Markdown
---
|
|
name: app-security
|
|
description: >
|
|
Harden affected application boundaries when implementing or auditing authorization, uploads, user-influenced outbound requests, or sensitive data handling.
|
|
scope: global
|
|
---
|
|
|
|
# Application security
|
|
|
|
Inspect the affected boundary and existing controls. Apply the protections relevant
|
|
to the task; a small fix does not require a full application audit.
|
|
|
|
1. Validate untrusted payloads with runtime schemas and resource bounds derived
|
|
from product requirements. Reject invalid data; do not silently truncate credentials.
|
|
2. Derive identity from verified server authentication. Enforce tenant/resource
|
|
permissions on private reads and writes, preferably within the data operation.
|
|
Cover unauthenticated access, cross-tenant access, and relevant races.
|
|
3. For uploads, enforce a product-specific extension/type allowlist, stream byte
|
|
limits, and appropriate content validation. Magic headers alone do not prove
|
|
safety. Use generated storage names and an isolated non-executable root; prevent
|
|
traversal and symlink escapes. Serve potentially active content with appropriate
|
|
isolation and headers. Bound archive expansion or decoding work when applicable.
|
|
4. For user-influenced outbound destinations, allowlist known services where possible.
|
|
Parse URLs, restrict schemes, resolve and validate all IPv4/IPv6 addresses, and
|
|
prevent DNS changes from bypassing connection checks. Disable redirects or validate
|
|
each destination using the same policy. Block private, loopback, link-local,
|
|
unspecified, and metadata targets unless a specific trusted internal service is
|
|
intentionally allowed. Apply time, response-size, and network egress limits.
|
|
5. Redact credentials at logging/telemetry boundaries and keep public errors free
|
|
of secrets and internal traces. Apply relevant session, CSRF, rate-limiting, and
|
|
browser content controls using existing framework facilities.
|
|
6. Verify the changed boundary with meaningful negative cases under
|
|
[shared verification](../../protocols/workflow.md#verification). Report actual
|
|
protections and gaps; do not claim the whole app is secure from a checklist.
|
|
|
|
Use [the playbook](references/app-hardening-playbook.md) for implementation choices
|
|
and [the checklist](references/review-checklist.md) for an explicitly requested audit.
|
|
Local fixtures need deliberate configuration, not an automatic security bypass.
|