From backend-development-assistant
Secure backend applications against OWASP threats. Implement authentication, encryption, scanning, compliance, and incident response procedures.
npx claudepluginhub pluginagentmarketplace/custom-plugin-backend --plugin backend-development-assistantThis skill uses the workspace's default tool permissions.
**Bonded to:** `testing-security-agent`
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
Bonded to: testing-security-agent
# Invoke security skill
"Check my code for OWASP vulnerabilities"
"Implement JWT authentication securely"
"Prepare for GDPR compliance audit"
| # | Vulnerability | Prevention | Severity |
|---|---|---|---|
| 1 | Broken Access Control | RBAC, least privilege | Critical |
| 2 | Cryptographic Failures | Strong encryption, TLS | Critical |
| 3 | Injection | Parameterized queries | Critical |
| 4 | Insecure Design | Threat modeling | High |
| 5 | Security Misconfiguration | Hardening | High |
| 6 | Vulnerable Components | SCA scanning | High |
| 7 | Auth Failures | MFA, secure sessions | High |
| 8 | Data Integrity Failures | Signatures | Medium |
| 9 | Logging Failures | Audit logging | Medium |
| 10 | SSRF | Input validation | Medium |
| Type | Purpose | Tools |
|---|---|---|
| SAST | Static code | SonarQube, Semgrep |
| DAST | Dynamic testing | OWASP ZAP, Burp |
| SCA | Dependencies | Snyk, Dependabot |
| Container | Images | Trivy, Grype |
| Secrets | Detection | GitLeaks, TruffleHog |
from fastapi import Depends, HTTPException
from fastapi.security import OAuth2PasswordBearer
from passlib.context import CryptContext
from jose import jwt
import secrets
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
def hash_password(password: str) -> str:
return pwd_context.hash(password)
def verify_password(plain: str, hashed: str) -> bool:
return pwd_context.verify(plain, hashed)
def create_token(user_id: str) -> str:
return jwt.encode(
{"sub": user_id, "jti": secrets.token_urlsafe(16)},
SECRET_KEY,
algorithm="HS256"
)
# BAD - Vulnerable to SQL injection
def get_user_bad(user_id: str):
query = f"SELECT * FROM users WHERE id = '{user_id}'"
return db.execute(query)
# GOOD - Parameterized query
def get_user_good(user_id: str):
query = "SELECT * FROM users WHERE id = :id"
return db.execute(query, {"id": user_id})
from fastapi import FastAPI
from starlette.middleware.base import BaseHTTPMiddleware
class SecurityHeadersMiddleware(BaseHTTPMiddleware):
async def dispatch(self, request, call_next):
response = await call_next(request)
response.headers["X-Content-Type-Options"] = "nosniff"
response.headers["X-Frame-Options"] = "DENY"
response.headers["X-XSS-Protection"] = "1; mode=block"
response.headers["Strict-Transport-Security"] = "max-age=31536000"
response.headers["Content-Security-Policy"] = "default-src 'self'"
return response
app = FastAPI()
app.add_middleware(SecurityHeadersMiddleware)
| Issue | Cause | Solution |
|---|---|---|
| Token expired | Short TTL | Implement refresh tokens |
| CORS blocked | Missing headers | Configure CORS properly |
| Weak encryption | Old algorithms | Use AES-256, RSA-2048+ |
| SQL injection | String concat | Use parameterized queries |
Incident Detected
│
├─→ Contain: Isolate affected systems
├─→ Assess: Determine scope
├─→ Remediate: Fix vulnerability
├─→ Recover: Restore services
└─→ Post-mortem: Document & improve
# tests/test_security.py
import pytest
class TestSecurityControls:
def test_password_is_hashed(self):
password = "secure123"
hashed = hash_password(password)
assert password not in hashed
assert verify_password(password, hashed)
def test_sql_injection_prevented(self):
malicious_input = "'; DROP TABLE users; --"
# Should not execute the DROP TABLE
result = get_user(malicious_input)
assert result is None # User not found, not table dropped
def test_auth_required_for_protected_routes(self, client):
response = client.get("/api/v1/users/me")
assert response.status_code == 401