Application security

What does a threat model list?

The assets, the actors, the boundaries, and the abuses you are choosing to stop. It is how you decide which fixes matter.

What is command injection?

Untrusted text is concatenated into a shell or a query and parsed as instructions. The fix is to pass it as data, not as code.

What stops SQL injection?

A parameter bound by the driver, separate from the statement. Escaping by hand fails on the encoding you forgot.

What is cross-site scripting?

Untrusted content is treated as markup or script in a victim's browser, in your origin. Encode it for the context it lands in.

What is stored XSS?

The payload is saved, then served later to other users. One write becomes every reader's problem.

What is DOM XSS?

Client script inserts untrusted text into a dangerous sink, such as HTML or a URL, without a trip through the server.

What does a strict content security policy do?

It tells the browser which script sources may run, so an injected inline script does not execute.

What do you check on a user-supplied link?

The scheme and the host against an allow list. Blocking a few bad schemes still leaves the ones you forgot.

What is server-side request forgery?

The server fetches a URL an attacker chose, and reaches an internal address the attacker could not. Validate the address after every redirect, and block internal ranges.

Why re-check the address after DNS and redirects?

The first lookup can return a public address and a later hop can land on a metadata service or a private IP.

What is cross-site request forgery?

A victim's browser sends the victim's cookies to your site on a request the attacker page triggered. A token the attacker cannot read stops it.

What does SameSite on a cookie do?

It limits when the browser attaches the cookie to a request that came from another site. It cuts some CSRF, and it is not the whole fix.

What is an insecure object reference?

Changing an id returns or changes someone else's object. Every read and write has to check that this caller may touch this id.

Where does an authorization check belong?

On the server, at the object, on every path. Hiding the button is not the check.

What should a session cookie be?

Random, HttpOnly, Secure, and expiring. A predictable session id is an account takeover.

Why use the same reset response either way?

A message that says the email is unknown tells an attacker which addresses are registered.

What is an algorithm-confusion bug in a JWT?

The token picks the algorithm, and a library is tricked into treating a public key as an HMAC secret, or accepting 'none'. Pin the algorithm.

Where do production secrets live?

In a secret store, injected at runtime, rotatable. A repository, an image, and a chat log are places they leak.

What is least privilege?

A person or a process gets only the access the job needs, for as long as it needs it. Standing admin for everyone fails that.

What is standing access?

Privilege that is always on. It turns one stolen laptop into a production incident. Just-in-time access shrinks the window.

What must an audit log resist?

The person whose action it records should not be able to edit it. Otherwise the first step after abuse is deleting the evidence.

Why HttpOnly for the session?

Script that runs in the origin, from XSS, still cannot read the cookie. It is a backstop, not a reason to allow XSS.

What is wrong with reflecting any Origin with credentials?

Any site can then make the victim's browser call you and read the response. Allow a list of origins.

What do you check on an upload?

The type you will actually process, a size limit, and a stored name you generated. The client's filename and content-type are not evidence.

What is path traversal?

A filename containing '..' escapes the directory you intended. Join against a canonical base and reject anything outside it.

What is XML external entity processing?

A parser fetches or expands an entity the document names, which can read files or reach the network. Disable that feature.

Why is deserializing untrusted objects dangerous?

The payload can name a type and trigger code on the way in. Parse an explicit data format instead.

A high-severity CVE is in a function you do not call. Now what?

Confirm the vulnerable path is unreachable, record that, and still plan the upgrade. 'Not called' today is not a pin forever.

What is a reachable vulnerability?

There is a path from attacker-controlled input to the bug. Severity without reach is not the order you patch in.

What does secret scanning catch?

Tokens committed to the repo. It does not catch a secret pasted in a ticket or pulled into a running container from outside the repo.

After a leaked key is contained, what is the useful follow-up?

How it leaked, which systems accepted it, and a control that makes the same leak noisy next time.

What security headers are worth setting?

A content security policy, a frame policy, and no sniffing. Each one closes a class of bug the app will eventually have.

What is clickjacking?

Your page is framed by an attacker's page, and the user clicks a control they cannot see. A frame policy stops the framing.

What is an open redirect?

A parameter chooses the URL you send the user to, and an attacker uses your domain to lend trust to a phishing site. Allow a list of destinations.

What is mass assignment?

Binding a request body onto an object that also contains is_admin or a price. Accept only the fields the user may set.

Why rate-limit login and reset?

Those routes are how guessing and stuffing happen. A limit, and a lockout you can explain, raises the cost.

How do you store a password?

With a slow, salted hash made for passwords. Encryption is reversible. A fast hash is guessable offline.

What does TLS protect?

The bytes in transit, against reading and tampering. It does not fix a bug in the application once the request is decrypted.

A service behind the gateway still needs what?

Its own check of identity and permission. Network location is not authentication. A request that skipped the gateway should fail.

What is the cloud metadata address doing in a SSRF?

It hands the instance's credentials to anyone who can make the server fetch it. Block the address, and require a session on the metadata service.

What do you keep out of logs?

Passwords, tokens, and full card numbers. A log store is a second copy of every secret you write there.

What is wrong with a stack trace to the client?

It names internal hosts, queries, and libraries. Log it on the server. Send the client an id they can quote.

Why never pass an upload path to a shell?

The name or the contents can break out of the command you intended. Call a library function with the path as an argument, after you have validated it.

What is server-side template injection?

User text is parsed as a template, and the template language can read or run more than you meant. Treat user text as data.

What is a time-of-check race on a permission?

You check access, then act, and the world changes in between. The check and the action have to be one step where it matters.

What is a step-up check?

A second confirmation for a dangerous action, so a stolen session alone cannot change the payout destination.

What is a dependency confusion risk?

A package name that resolves to an attacker's publish instead of your private one. Pin the registry and the version.

A lead says the finding cannot be exploited. What do you do?

Show the request that exploits it, or agree and write down why it is not reachable. An assertion without either is not a close.

When is a security fix done?

When a test or a replay of the original request fails to exploit it, in the build you will ship.