# Security Test Matrix — Layer-Aware Testing Coverage

**Purpose:** Classify security attack surfaces by **who tests them** — Layer 1 manual-testable (PE, via browser/Postman), Layer 2 tool-required (DSE), Layer 3 Autoable.

**Used by:**
- `/tas-TestChecklist` — **all sections** (Phase 1.5.2 scope + Phase 2.1 TP generation; the Gap Prevention Rules + Integration sections below are TestChecklist process).
- `/tas-apitest-plan` — **classification tables only** (Layer 1/2/3 + Priority Mapping); skip the TestChecklist-process sections.

---

## Layer 1: Manual-Testable Security (PE Scope)

> **Rule:** If a security check can be performed via browser DevTools, Postman, or visual inspection → PE generates TP in TestChecklist.
> **Rationale:** Functional security (XSS, CSRF, input sanitization) is PE's responsibility, not just DSE's.

| # | Category | Attack Vector | Manual Test Approach | Expected Outcome | Tool |
|---|----------|---------------|---------------------|------------------|------|
| 1 | **Input Sanitization** | XSS Reflected | Enter `<script>alert(1)</script>` in Card 3 medication field → submit → check GET response | Escaped in response body, NOT raw HTML | Browser DevTools |
| 2 | **Input Sanitization** | XSS Stored | Enter script payload → submit → GET draft → check response | Escaped/sanitized in GET response | Postman |
| 3 | **Input Sanitization** | SQL Injection | Enter `' OR 1=1 --` in textarea → submit | 400 Bad Request or sanitized, NOT 500 DB error | Postman |
| 4 | **Input Sanitization** | Path Traversal | Upload file named `../../etc/passwd.jpg` | 400 Blocked, file NOT served | Browser DevTools |
| 5 | **Auth Bypass** | Missing Token | Remove Authorization header from request | 401/403, not data exposure | Postman |
| 6 | **Auth Bypass** | Expired Token | Use expired JWT | 401 Unauthorized, clear session redirect | Postman |
| 7 | **Auth Bypass** | Malformed Token | Use corrupted JWT | 401 Unauthorized, not 500 error | Postman |
| 8 | **Data Exposure** | PII in Response | Check API response for SSN, full card, password hash | PII masked or absent | Postman |
| 9 | **Data Exposure** | Error Detail | Trigger 500 error → check response body | Generic message, NO stack trace/DB query/internal path | Browser DevTools |
| 10 | **Data Exposure** | Draft API BOLA | Access User A's draft with User B's token | 403 Forbidden, not data leak | Postman |
| 11 | **Security Headers** | Sensitive Headers | Check response headers for `Server:`, `X-Powered-By` | Headers absent or generic | Browser DevTools |
| 12 | **HTTPS** | Mixed Content | Check network tab for HTTP resources on HTTPS page | All resources HTTPS, no mixed content warnings | Browser DevTools |

**TP Generation Rule:** For Feature-003 questionnaire flow → auto-generate F003-SEC-001 (XSS reflected) + F003-SEC-002 (XSS stored) + F003-SEC-003 (SQL injection) in TestChecklist §2.1.

---

## Layer 2: Tool-Required Security (DSE Scope)

> **Rule:** If security check requires specialized tools (Burp Suite, OWASP ZAP, npm audit) → surface as `[SEC-TOOL]` risk in TestChecklist §5, routed to `/tas-apitest-plan` or `/tas-security`.
> **Rationale:** Infrastructure-level security (TLS cipher config, dependency vulns) is DevOps/DSE responsibility.

| # | Category | Attack Vector | Required Tool | Owner | Risk Tag |
|---|----------|---------------|---------------|--------|----------|
| 1 | **TLS Configuration** | Weak Cipher Suite | SSL Labs Test, nmap | DSE | `[SEC-TOOL]` |
| 2 | **Dependency Vulns** | npm/nuget package CVE | npm audit, Snyk | SE | `[SEC-TOOL]` |
| 3 | **Secrets Scanning** | API keys in code | GitLeaks, truffleHog | DSE | `[SEC-TOOL]` |
| 4 | **Static Analysis** | Code-level vulnerabilities | SonarQube, Fortify | DSE | `[SEC-TOOL]` |
| 5 | **DAST** | Automated vulnerability scan | OWASP ZAP, Burp Suite | DSE | `[SEC-TOOL]` |
| 6 | **Penetration Testing** | Human-led exploit simulation | Manual pentest engagement | Security Team | `[SEC-TOOL]` |

**TestChecklist §5 Risk Entry Example:**
```
Risk ID:     [SEC-TOOL-001]
Title:       Static analysis + dependency scan not covered by PE tests
Level:       HIGH
Category:    RC-SEC
Owner:       DSE
Mitigation:  Run /tas-security + OWASP ZAP scan before release
Linked TPs:  None (tool-required, not PE-testable)
```

---

## Layer 3: Autoable Classification for Security TPs

| Attack Vector | Autoable? | Rationale | Tool Support |
|---------------|-----------|-----------|--------------|
| SQL/NoSQL Injection | ✅ YES | Scripted payload + assert response code | Postman |
| XSS Reflected | ✅ YES | Scripted payload + assert response body | Postman |
| XSS Stored | ✅ YES | Scripted POST + GET assert | Postman |
| BOLA/IDOR | ✅ YES | Scripted token swap + assert 403 | Postman |
| Auth Bypass (missing/expired/malformed) | ✅ YES | Scripted token variants | Postman |
| Mass Assignment | ✅ YES | Scripted extra-field POST + assert no extra field in response | Postman |
| Rate Limiting | ⚠️ PARTIAL | Requires loop script; timing-sensitive | Postman + JavaScript |
| SSRF | ✅ YES | Scripted URL injection + assert blocked | Postman |
| Security Headers | ✅ YES | Assert header presence/value | Postman |
| Path Traversal | ✅ YES | Scripted filename injection + assert blocked | Postman |
| Pentest Recon | ❌ NO | Human-led, tool-assisted | Manual |
| External API Failure (API10) | ⚠️ PARTIAL | Requires mock setup | Postman + Mock Server |

**Implication:** If `Autoable = YES`, `/tas-functest-web` or `/tas-apitest-plan` can generate automated TCs. If `NO` or `PARTIAL` → manual test case.

---

## Priority Mapping for Security TP Generation

**Priority 1 (Always Cover — P0):**
- API1 BOLA (Broken Object Level Auth)
- API2 Broken Authentication (missing/expired/malformed token)
- Injection (SQL/XSS reflected/XSS stored)
- Data Exposure (PII in response, error detail)

**Priority 2 (Cover if Applicable — P1):**
- API3 Mass Assignment
- API7 SSRF
- API8 Security Misconfiguration (headers)
- Path Traversal

**Priority 3 (Cover if Documented — P2):**
- API4 Rate Limiting
- API6 Sensitive Business Flows (state skip, replay)
- API9 Inventory Management (deprecated endpoints)

**Rule for TestChecklist Generation:**
- If Feature has text input fields → auto-generate Priority 1 injection TPs
- If Feature has auth-protected endpoints → auto-generate Priority 1 auth TPs
- If Feature has file upload → auto-generate Priority 2 path traversal TP
- Document SKIP with reason if vector does not apply

---

---

> **TestChecklist-only below this line.** `/tas-apitest-plan` does not need the following — they describe how TestChecklist generates and populates TPs.

## Gap Prevention Rules for TestChecklist

### Rule 1: Functional ≠ Infrastructure Security

**Problem:** TestChecklist §1.2 (Out-of-Scope) incorrectly marks ALL security as "Tool-Based / DSE" → functional security (XSS, CSRF, input sanitization) missing.

**Fix:**
```markdown
| Item | Category | Owner | Note |
|------|----------|-------|------|
| Functional security (XSS, CSRF, input sanitization) | Security | PE | Manual UI/API checks → IN TestChecklist |
| Infrastructure security (TLS ciphers, dependency vulns) | Security | DSE | Tool-required → OUT TestChecklist, route to §5 risk |
```

### Rule 2: "Deferred" ≠ "Out-of-Scope"

**Problem:** Accessibility marked as "Deferred" → removed from TestChecklist entirely.

**Fix:** Add `Status` column to §1.2 Out-of-Scope:
```markdown
| Item | Category | Owner | Status | Note |
|------|----------|-------|--------|------|
| WCAG 2.1 AA certification | Compliance | Product | Deferred | Basic a11y checks included; full cert → Phase 3 |
```

**Rule:** Deferred items still generate TPs in TestChecklist §2.1 but tagged with `Status: Deferred` in TP metadata.

### Rule 3: Platform NFR Baseline Must Be Read

**Problem:** Phase 1.5.4 confirms "Platform = Web" but does NOT read `performance-test-baseline.md` Layer 2 → accessibility + responsive gaps.

**Fix:** Update `/tas-TestChecklist` Phase 1.5.4 logic:
1. Confirm platform (web|app|all)
2. **Immediately READ** corresponding NFR baseline from `test-design.md`:
   - web → Read § Platform NFR Baselines → web
   - app → Read § Platform NFR Baselines → app
3. Auto-populate §2.2 In-Scope NFRs with ALL baseline categories
4. If baseline item marked "Deferred" in Feature.md → tag TP with `Status: Deferred`

### Rule 4: Gap Detection Must Scan Technical Notes

**Problem:** Gap Detection (Phase 1.5.2.5) only scans AC text → misses integration patterns in Technical Notes (e.g., POST /api/draft retry logic).

**Fix:** Extend Gap Detection keyword scan to include:
- Feature-Technical.md sections (if exists)
- PRD FR sections (integration-specific requirements)
- Keywords: "api", "webhook", "retry", "timeout", "external", "third-party"

### Rule 5: State Machine Edges Require Full ISTQB State Transition

**Problem:** Gap Detection triggers questions but does NOT auto-generate TPs for all state machine patterns (concurrent edits, race conditions).

**Fix:** Add State Transition TP generation rule:
- **Pattern:** Multi-step flow with draft/save/resume OR payment/confirmation
- **Auto-generate TPs:**
  - Concurrent edits: 2 tabs with same draft_id → edit Tab A → submit Tab B → verify conflict
  - Race condition: Double-click "Pay" → verify only 1 transaction created
  - Abandonment: Start draft → close browser → wait 24h → verify draft auto-deleted
- **Source:** ISTQB State Transition technique + Gap Pattern #1 (State Persistence)

---

## Integration with TestChecklist Generation

### Phase 1.5.3B: NFR Population (Updated)

**Current Logic:**
```
Read test-design.md → Platform NFR Baselines → Populate §2.2
```

**Updated Logic:**
```
1. Read test-design.md → Platform NFR Baselines → Populate §2.2
2. READ security-test-matrix.md (this file)
3. For each text input field in Feature → auto-generate Layer 1 security TPs (XSS, SQL injection)
4. For each auth-protected endpoint → auto-generate Layer 1 auth TPs (missing/expired/malformed token)
5. For each file upload field → auto-generate Layer 1 path traversal TP
6. For Layer 2 (tool-required) items → populate §5 Risk Registry with [SEC-TOOL] tag
```

### Phase 1.5.2.5: Gap Detection (Updated)

**Current Logic:**
```
Scan AC text → 12 gap patterns → Ask questions
```

**Updated Logic:**
```
1. Scan AC text → 12 gap patterns → Ask questions
2. SCAN Technical Notes + PRD FR sections → Integration-specific patterns (retry, timeout, webhook)
3. APPLY State Transition TP generation for multi-step flows (concurrent edits, race conditions, abandonment)
4. VERIFY accessibility + responsive baselines read from test-design.md
5. IF "Deferred" in Feature.md → still generate TPs but tag with Status: Deferred
```

---

## Metadata for TP Generation

**TP ID Convention:** `{FEATURE}-SEC-{NNN}` for Layer 1 security TPs
**Priority Mapping:** Priority 1 → P0, Priority 2 → P1, Priority 3 → P2
**Test Approach:** "Input Sanitization" (Layer 1) or "Auth Bypass" (Layer 1) or "Configuration Check" (Layer 1)
**Source Reference:** security-test-matrix.md Layer 1 table row #
**Dedup Rule:** If same input field accepts same injection across multiple endpoints → 1 TP per injection type, shared across flows