Security Audit Skill

OWASP Top 10 Checks

1. Broken Access Control

# ❌ WRONG: No authorization check
@router.delete("/users/{user_id}")
async def delete_user(user_id: int):
    await db.delete(User, user_id)

# ✅ RIGHT: Check permissions
@router.delete("/users/{user_id}")
async def delete_user(user_id: int, current_user: User):
    if user_id != current_user.id and current_user.role != "admin":
        raise HTTPException(403, "Not authorized")
    await db.delete(User, user_id)

2. Cryptographic Failures

# ❌ WRONG: Store plain password
user.password = password

# ✅ RIGHT: Hash password
user.password = hashlib.sha256(password.encode()).hexdigest()
# Better: use bcrypt/argon2
from passlib.context import CryptContext
pwd_context = CryptContext(schemes=["bcrypt"])
user.password = pwd_context.hash(password)

3. Injection Attacks

# ❌ WRONG: SQL injection
query = f"SELECT * FROM users WHERE email = '{email}'"

# ✅ RIGHT: Parameterized queries
query = select(User).where(User.email == email)

4. Insecure Design

• Input validation on ALL endpoints
• Rate limiting on sensitive operations
• CSRF tokens for state changes
• CORS properly configured

5. Security Misconfiguration

# ❌ WRONG: Debug in production
app = FastAPI(debug=True)

# ✅ RIGHT: Debug only in dev
app = FastAPI(debug=os.getenv("ENVIRONMENT") == "development")

6. Vulnerable & Outdated Components

• Pin dependencies versions
• Regular security updates
• Audit packages: pip audit
• Use dependabot/renovate

7. Authentication Failures

# ✅ Best Practice: JWT with expiration
token = jwt.encode(
    {
        "sub": user.id,
        "exp": datetime.utcnow() + timedelta(hours=24)
    },
    SECRET_KEY,
    algorithm="HS256"
)

8. Software & Data Integrity Failures

• Verify package signatures
• Use HTTPS only
• Sign API responses (when needed)

9. Logging & Monitoring Failures

# ✅ Log security events
logger.warning(f"Failed login attempt for {email}")
logger.error(f"SQL error encountered: {error_code}")
# BUT: Never log passwords, tokens, PII!

10. Server-Side Request Forgery (SSRF)

• Validate URLs before fetching
• Whitelist allowed domains
• Disabled redirects to internal IPs

Checklist

• All inputs validated
• Passwords hashed (bcrypt/argon2)
• No hardcoded secrets
• CORS configured properly
• Rate limiting active
• Errors don't leak info
• HTTPS only
• Security headers set