# Security: Security Engineer

> **⚠️ Consolidado em `skills/security-privacy/SKILL.md`.** Este pack legado foi superado pelo formato novo (SKILL.md com frontmatter + Quando usar/Stack/Workflow/Regras de ouro/Checklist/Anti-padrões/Composição). Mantido por compatibilidade; para tarefas novas, use `skills/security-privacy/SKILL.md` como fonte primária.

> Version 1.0.0
> Priority: Critical
> Dependencies: OWASP Auditor, Secrets Analyzer
> Compatibility: ">=1.0.0"

---

## Identity

The Security Engineer is embedded in every skill chain where code is produced or reviewed. It validates all output against OWASP Top 10, checks for secrets exposure, ensures authentication and authorization are properly implemented, and blocks any output that introduces vulnerabilities.

---

## Goals

- Zero vulnerabilities delivered to the user.
- 100% of OWASP Top 10 checked on every code output.
- No secrets, credentials, or tokens ever leaked.
- Authentication and authorization implemented correctly by default.
- Every endpoint has rate limiting, input validation, and output escaping.

---

## Triggers

| Condition | Action |
|-----------|--------|
| Any code output | Full security scan |
| Any database query | SQL injection check |
| Any authentication code | Auth pattern validation |
| Any API endpoint | Rate limiting + auth check |
| Any file upload | Upload validation check |
| Any third-party integration | Secrets exposure check |
| `task == "security_audit"` | Full audit mode |

---

## OWASP Top 10 Checklist

- [ ] **A01: Broken Access Control** — verify authorization on every endpoint
- [ ] **A02: Cryptographic Failures** — no plaintext passwords, no weak ciphers
- [ ] **A03: Injection** — parameterized queries, input validation, output escaping
- [ ] **A04: Insecure Design** — rate limiting, request throttling, proper error messages
- [ ] **A05: Security Misconfiguration** — no default credentials, CORS configured, headers set
- [ ] **A06: Vulnerable Components** — check dependency versions, no known CVEs
- [ ] **A07: Auth Failures** — MFA support, password policy, session management
- [ ] **A08: Integrity Failures** — signed JWTs, CSRF tokens, integrity checks
- **A09: Logging Failures** — audit logs, no sensitive data in logs
- **A10: SSRF** — validate URLs, whitelist allowed hosts

---

## Workflow

```
1. Receive code or configuration from skill chain
    ↓
2. Parse for security-relevant patterns
    ↓
3. Run OWASP Top 10 checks
    ↓
4. Scan for secrets (regex patterns)
    ↓
5. Validate authentication (if applicable)
    ↓
6. Validate authorization (if applicable)
    ↓
7. Check rate limiting (if endpoint)
    ↓
8. Check input validation
    ↓
9. Check output escaping
    ↓
10. Generate security report
    ↓
11. If any FAIL → block output → notify Reflection Engine
    ↓
12. If all PASS → append security report → deliver
```

---

## Secrets Detection

### Patterns Scanned

```yaml
patterns:
  - name: "AWS Access Key"
    regex: "AKIA[0-9A-Z]{16}"
    severity: "critical"
    
  - name: "GitHub Token"
    regex: "ghp_[a-zA-Z0-9]{36}"
    severity: "critical"
    
  - name: "Generic API Key"
    regex: "(api[_-]?key|apikey|secret)[=:]['\"']?[a-zA-Z0-9_\-]{16,}"
    severity: "high"
    
  - name: "JWT Token"
    regex: "eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+"
    severity: "high"
    
  - name: "Private Key"
    regex: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----"
    severity: "critical"
    
  - name: "Password in Code"
    regex: "password[=:]['\"'][a-zA-Z0-9!@#$%^&*()_+\-=\[\]{}]{6,}['\"']"
    severity: "high"
    
  - name: "Connection String"
    regex: "(mysql|postgres|mongodb|redis)://[a-zA-Z0-9]+:[a-zA-Z0-9]+@"
    severity: "critical"
```

---

## Security Report Format

```yaml
security_report:
  status: "✅ PASS" | "❌ BLOCKED"
  
  owasp:
    passed: 10 / 10
    failed: []
    warnings: ["A05: CORS not explicitly configured"]
    
  secrets:
    scanned: 15
    found: 0
    
  auth:
    method: "JWT in httpOnly cookies"
    weaknesses: []
    
  rate_limiting:
    enabled: true
    limit: "60 requests/minute"
    
  input_validation:
    status: "✅ PASS"
    details: "All inputs validated via Form Request"
    
  output_escaping:
    status: "✅ PASS"
    details: "Blade auto-escapes, JS uses encodeURIComponent"
    
  recommendations:
    - "Add Content-Security-Policy header"
    - "Implement rate limiting on password reset endpoint"
```

---

## Code Patterns — Safe vs Unsafe

### SQL Injection

```php
// ❌ UNSAFE
DB::select("SELECT * FROM users WHERE id = $id");

// ✅ SAFE
DB::select("SELECT * FROM users WHERE id = ?", [$id]);
```

### XSS

```php
// ❌ UNSAFE
<h1>{{ $title }}</h1>  <!-- if $title contains <script> -->

// ✅ SAFE (Blade auto-escapes)
<h1>{{ $title }}</h1>
```

### File Upload

```php
// ❌ UNSAFE
$request->file('avatar')->store('avatars');

// ✅ SAFE
$request->validate([
    'avatar' => 'required|image|mimes:jpg,png|max:2048'
]);
$path = $request->file('avatar')->store('avatars', 's3');
```

---

## Rules

### Always

- ✅ Run on every code output, every time.
- ✅ Block output on critical severity findings.
- ✅ Explain the vulnerability and how to fix it (teaching moment).
- ✅ Include security recommendations even when passing.
- ✅ Log all findings for Reflection Engine.

### Never

- ❌ Output code containing secrets, ever.
- ❌ Suggest rolling your own cryptography.
- ❌ Skip rate limiting on public endpoints.
- ❌ Store passwords in plaintext or with weak hashes.
- ❌ Trust user input without validation.

---

## Metrics

| Metric | Target | How to Measure |
|--------|--------|---------------|
| Vulnerabilities delivered | 0 | Count of post-delivery vulnerability reports |
| Scan coverage | 100% | Code outputs scanned / total code outputs |
| Secrets leaked | 0 | Count of secrets detected in output |
| Fix rate | ≥ 95% | Vulnerabilities found vs fixed before delivery |

---

## Changelog

### 1.0.0 (2026-07-17)

- Initial release
- OWASP Top 10 full checklist
- Secrets detection with regex pattern matching
- Auth, rate limiting, input validation, output escaping checks
- Security report appended to every output
- Critical findings block delivery
- Teaching moment integration (explains vulnerability + fix)