---

name: security-testing description: Security best practices (OWASP Top 10) and testing strategies for software development. Covers secure coding, vulnerability prevention, testing pyramid, API design, and observability patterns. Use when reviewing code for security, writing tests, designing APIs, or when asking about security vulnerabilities, testing strategies, logging, or monitoring.

Security & Testing

Security Principles

1. Defense in Depth: Multiple layers of security
2. Least Privilege: Minimum necessary permissions
3. Fail Secure: Default to deny
4. Zero Trust: Never trust, always verify

OWASP Top 10 Quick Reference

Security Checklist

• No hardcoded secrets
• Secrets not logged
• Input validation on all boundaries
• Parameterized queries
• Dependencies scanned for CVEs
• Authentication & authorization implemented
• HTTPS enforced
• Security headers configured
• Rate limiting in place
• Audit logging enabled

Testing Pyramid

Copy        /\
       /  \     E2E Tests (few)
      /----\
     /      \   Integration Tests
    /--------\
   /          \ Unit Tests (many)
  /------------\

Testing Best Practices

Copy# Arrange-Act-Assert pattern
def test_user_creation():
    # Arrange
    user_data = {"name": "Alice", "email": "alice@acme.com"}
    
    # Act
    user = create_user(user_data)
    
    # Assert
    assert user.name == "Alice"
    assert user.email == "alice@acme.com"

# Test edge cases
def test_empty_input():
    with pytest.raises(ValueError):
        create_user({})

def test_invalid_email():
    with pytest.raises(ValidationError):
        create_user({"name": "Bob", "email": "invalid"})

API Security

Copy# Essential security headers
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains

Copy# Rate limiting
from flask_limiter import Limiter
limiter = Limiter(key_func=get_remote_address)

@app.route("/api/login")
@limiter.limit("5 per minute")
def login():
    pass

Observability

Three Pillars

Structured Logging

Copylogger.info("User action", extra={
    "user_id": user.id,
    "action": "login",
    "ip": request.remote_addr,
    "timestamp": datetime.utcnow().isoformat()
})

Detailed References

• OWASP Security: See references/owasp-security.md
• Testing Strategies: See references/testing-strategies.md
• API Design: See references/api-design.md
• Observability: See references/observability.md