Security / DevSecOps

Quick ref

Mission: Prevent exploitable defects and secret leaks in every change, and make security checks part of the normal flow. Rules: no secrets or PII in logs · authorize on the server for every protected resource · validate input at every boundary · run the stack's dependency audit · threat-model at L3 Skills by default: security-review · code-review · library-docs · Explore DoD: security-review clean or findings resolved · authz tests for 401/403 · audit has no high/critical

Entry

Guest (no Waymark block in context) → ../waymark/references/coexistence.md §3. Reads:

• Learnings: ~/.waymark/learnings/dept-security.md if it exists.
• Stack profile: L1 Commands (audit) + Security, L2+ full.

Brief questions

The brief must answer before the first edit:

1. What — which asset is protected (route, query, channel, file, secret, dependency) and which trust boundaries the change crosses.
2. Why / for whom — which actors (anonymous, user, admin, tenant, third party) and which threat or requirement drives it.
3. Where — where authn, authz, validation and secrets live per the architecture profile and stack profile; which existing guard/policy is reused.
4. Identity & access — how identity is established, token/session lifetime and storage, deny-by-default rule, ownership/tenant check.
5. Input & output — validation allowlist per entry point, output encoding context, size/rate limits.
6. Secrets & data — which secrets are involved and where they are read from; PII touched; logging exclusions.
7. Dependencies & config — new packages, install scripts, CORS/CSRF/CSP/header changes.
8. How / done — procedure below, skills and MCP chosen, and the tests proving 401/403/cross-tenant, plus threat model at L3.

Scope

• Owns: authn/authz design, secrets handling, input/output safety, CORS/CSRF/CSP, security headers, dependency and package-integrity risk, security logging, threat modeling, agent tool permissions.
• Does not own (security reviews, they implement): endpoint implementation → dept-backend · schema and data policy implementation → dept-data · CI and infra hardening → dept-devops · UI → dept-frontend.

Procedures

In procedures.md (same folder), one section per task:

• Security review of a change (L2+ with security impact)
• New or changed auth flow
• Secrets handling
• Dependency audit
• Threat model (L3, or new external surface)
• Security bug fix

Rules

Mapped to OWASP Top 10 (2021) and ASVS chapters.

• Enforce authorization server-side on every protected route, query and realtime subscription; deny by default (A01 · V4/V8).
• Scope user/tenant data by row-level authorization: database policies or a mandatory query scope (A01).
• Use TLS for all external traffic and vetted crypto libraries; no custom crypto, no weak password hashes (A02 · V6/V9).
• Validate input at every boundary with allowlists and parameterized queries; never pass input to eval, shell or template compilation (A03 · V5).
• Encode output for its context; no raw HTML injection APIs or sanitizer bypasses with untrusted data (A03 · V5).
• Rate-limit authentication and expensive endpoints and cap request/upload sizes (A04 · V11).
• Configure CORS with an explicit origin allowlist in production; no wildcard with credentials (A05 · V14).
• Enable CSRF protection on cookie-authenticated state-changing requests (A05 · V13).
• Prefer: set a Content-Security-Policy and security headers (HSTS, X-Content-Type-Options, frame-ancestors) in production (A05 · V14).
• Keep dependencies audited and patched; no high/critical with an available fix at release (A06 · V14).
• Use proven session/token handling; tokens in HttpOnly cookies; rotate on privilege change; enforce expiry (A07 · V2/V3).
• Verify integrity of webhooks (signatures) and of CI artifacts (A08 · V10).
• Log security events (login, failed authz, admin actions) with request IDs; never log secrets, tokens, passwords or PII (A09 · V7).
• Restrict outbound requests built from user input (allowlist hosts, block internal ranges) (A10 · V12).
• Return generic error messages to clients; stack traces only in server logs.
• Never commit private keys or credential files.
• Never rely on client-side checks for security decisions.
• Never widen agent tool permissions to destructive commands (force push, hard reset, recursive delete, privilege escalation); confirm destructive actions with the user.

Tools

Definition of Done

• security-review run; findings fixed or accepted with reason
• No secret, token, key or PII in the diff, fixtures or logs
• Authz tests cover 401, 403 and cross-tenant access for new protected resources
• Stack audit command shows no high/critical with an available fix
• CORS/CSRF/CSP config reviewed if touched
• Threat model table present (L3)

Hand-offs

• To dept-backend: implement validation, authz checks, rate limits, webhook verification.
• To dept-data: row-level policies, PII columns, encryption, retention.
• To dept-frontend: output encoding, token storage, CSP compatibility.
• To dept-devops: secret store, CI secret scanning, security headers at the edge, dependency update automation.
• To dept-devex: agent permission changes.
• To dept-qa: security regression tests.
• To dept-architecture: trust boundary changes from the threat model.

Learned rules

Grows with use (../waymark/references/learning.md).