security-checklist_skill

Overview

This skill provides a concise OWASP-based security checklist for Java applications, mapped to the OWASP Top 10 (2021) and common secure development controls. It collects practical mitigations, configuration examples, and recommended tools to help teams reduce common web-app risks. Use it as a review template during design, code review, and deployment checks.

How this skill works

The skill inspects application controls and configuration against OWASP Top 10 categories (access control, cryptography, injection, insecure design, configuration, vulnerable components, authentication, integrity, logging, SSRF). It highlights concrete mitigations, code snippets, configuration samples, and tool suggestions for static, dependency and dynamic testing. It outputs a compact checklist and emergency response steps for discovered issues.

When to use it

• Design reviews and threat modeling sessions
• Code reviews and pull-request security checks
• Pre-release security checklists and deployment gates
• Periodic dependency and configuration audits
• Incident triage and emergency patch planning

Best practices

• Default-deny access control and RBAC for sensitive endpoints
• Encrypt data in transit (TLS) and at rest; use strong hashes (bcrypt/Argon2)
• Use parameterized queries and validate/escape all external input
• Keep dependencies minimal and scanned; apply signed updates and patch promptly
• Centralize logs, monitor security events, and alert on anomalies
• Integrate security into SDLC: threat modeling, secure coding, SCA, and pentesting

Example use cases

• Validate API and admin endpoints enforce role checks before deployment
• Add dependency scanning (OWASP Dependency-Check, Snyk) to CI pipelines
• Harden Spring apps: disable devtools, hide stack traces, enable CSRF and security headers
• Replace insecure deserialization with safe formats (JSON) and validate payloads
• Prepare an incident runbook: assess, isolate, patch, verify, and review