Application Security

---
name: application-security
description: Secure applications against common vulnerabilities. Use when reviewing code for security, implementing security controls, or hardening applications. Covers OWASP Top 10.
allowed-tools: Read, Glob, Grep
---

# Application Security

## OWASP Top 10 (2021)

### 1. Broken Access Control
**Risk**: Users accessing unauthorized resources.

**Prevention**:
- Deny by default
- Implement RBAC/ABAC
- Validate permissions server-side
- Log access failures

### 2. Cryptographic Failures
**Risk**: Sensitive data exposure.

**Prevention**:
- Encrypt data at rest and in transit
- Use strong algorithms (AES-256, RSA-2048+)
- Never store passwords in plaintext
- Use secure key management

### 3. Injection
**Risk**: Malicious input executed as code.

**Prevention**:
```java
// ❌ BAD - SQL injection vulnerability
@GetMapping("/users/{id}")
public User getUser(@PathVariable String id) {
    String query = "SELECT * FROM users WHERE id = " + id;
    return jdbcTemplate.queryForObject(query, User.class);
}

// ✅ GOOD - Use JPA/Spring Data (parameterized by default)
@Repository
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findById(Long id);
}

// ✅ GOOD - JPQL with named parameters
@Query("SELECT u FROM User u WHERE u.email = :email AND u.status = :status")
Optional<User> findByEmailAndStatus(
    @Param("email") String email,
    @Param("status") UserStatus status
);

// ❌ BAD - Command injection
Runtime.getRuntime().exec("ls " + userInput);

// ✅ GOOD - Use ProcessBuilder with separate arguments
ProcessBuilder pb = new ProcessBuilder("ls", userInput);
Process p = pb.start();
```

### 4. Insecure Design
**Risk**: Missing security controls by design.

**Prevention**:
- Threat modeling
- Security requirements
- Defense in depth

### 5. Security Misconfiguration
**Risk**: Default or weak configuration.

**Prevention**:
- Disable unnecessary features
- Remove default credentials
- Keep software updated
- Harden server configuration

### 6. Vulnerable Components
**Risk**: Using libraries with known vulnerabilities.

**Prevention**:
- Regular dependency audits
- Keep dependencies updated
- Monitor CVE databases

### 7. Authentication Failures
**Risk**: Weak or broken authentication.

**Prevention**:
- Multi-factor authentication
- Strong password policies
- Secure session management
- Rate limiting on login

### 8. Software & Data Integrity
**Risk**: Untrusted sources for updates.

**Prevention**:
- Verify code signatures
- Use SRI for CDN resources
- Secure CI/CD pipeline

### 9. Logging & Monitoring Failures
**Risk**: Attacks go undetected.

**Prevention**:
- Log security events
- Monitor for anomalies
- Alert on suspicious activity

### 10. Server-Side Request Forgery
**Risk**: Server makes requests to unintended destinations.

**Prevention**:
- Validate URLs
- Use allowlists
- Block internal IPs