# Security Scanning > **Skill Purpose:** API security assessment, vulnerability scanning, and security validation procedures --- ## Core Skill Pattern **Objective:** Establish comprehensive security scanning strategy with automated vulnerability detection, security testing, and compliance validation. **Universal Pattern:** 1. Define security scanning strategy and scope 2. Create automated vulnerability scanning procedures 3. Establish security testing patterns 4. Set up compliance validation and reporting 5. Create security remediation and tracking procedures **Key Decisions (Project-Specific):** - Security scanning tools and frameworks - Vulnerability severity thresholds and policies - Security testing depth and coverage - Compliance requirements and standards - Remediation timelines and procedures --- ## Project-Specific Implementation Notes **Customize per project:** - Security tools based on tech stack and compliance needs - Scanning frequency based on deployment cadence - Vulnerability thresholds based on risk tolerance - Testing depth based on data sensitivity - Remediation approach based on team capabilities --- ## Example Implementation (API Security Pattern) > **Note:** This is an example pattern using automated security scanning with Snyk, npm audit, and custom security tests. Adapt security tools and patterns based on your specific project requirements and compliance standards. ### Prerequisites (Example) - API endpoints identified and documented - Security requirements and compliance standards defined - Security scanning tools selected and configured - Vulnerability management process established --- ## Example: API Security Implementation > **Framework-Specific Example:** This demonstrates API security patterns with Next.js and automated scanning. Adapt for your security framework and API requirements. ### Security Configuration ```typescript // lib/security-config.ts export interface SecurityConfig { rateLimiting: { windowMs: number; maxRequests: number; }; authentication: { jwtSecret: string; tokenExpiry: string; }; validation: { maxPayloadSize: number; allowedOrigins: string[]; }; scanning: { enabled: boolean; severityThreshold: 'low' | 'medium' | 'high' | 'critical'; scanInterval: number; // hours }; } export const securityConfig: SecurityConfig = { rateLimiting: { windowMs: 15 * 60 * 1000, // 15 minutes maxRequests: 100, }, authentication: { jwtSecret: process.env.JWT_SECRET || 'fallback-secret', tokenExpiry: '24h', }, validation: { maxPayloadSize: 10 * 1024 * 1024, // 10MB allowedOrigins: [ 'http://localhost:3000', 'https://yourdomain.com', ], }, scanning: { enabled: process.env.NODE_ENV === 'production', severityThreshold: 'medium', scanInterval: 24, }, }; ``` ### Security Middleware ```typescript // middleware/security.ts import { NextResponse } from 'next/server'; import type { NextRequest } from 'next/server'; import { securityConfig } from '../lib/security-config'; export function securityMiddleware(request: NextRequest) { const response = NextResponse.next(); // Security headers response.headers.set('X-Content-Type-Options', 'nosniff'); response.headers.set('X-Frame-Options', 'DENY'); response.headers.set('X-XSS-Protection', '1; mode=block'); response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin'); response.headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()'); // CORS validation const origin = request.headers.get('origin'); if (origin && !securityConfig.validation.allowedOrigins.includes(origin)) { return NextResponse.json( { error: 'Origin not allowed' }, { status: 403 } ); } // Payload size validation const contentLength = request.headers.get('content-length'); if (contentLength && parseInt(contentLength) > securityConfig.validation.maxPayloadSize) { return NextResponse.json( { error: 'Payload too large' }, { status: 413 } ); } return response; } export const config = { matcher: ['/api/:path*'], }; ``` ### Input Validation Security ```typescript // lib/security-validation.ts import { z } from 'zod'; export class SecurityValidator { static sanitizeInput(input: string): string { return input .trim() .replace(/[<>]/g, '') // Remove potential HTML tags .replace(/javascript:/gi, '') // Remove javascript: protocol .replace(/on\w+=/gi, ''); // Remove event handlers } static validateEmail(email: string): boolean { const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; return emailRegex.test(email) && email.length <= 254; } static validatePassword(password: string): { isValid: boolean; errors: string[]; } { const errors: string[] = []; if (password.length < 8) { errors.push('Password must be at least 8 characters long'); } if (!/[A-Z]/.test(password)) { errors.push('Password must contain at least one uppercase letter'); } if (!/[a-z]/.test(password)) { errors.push('Password must contain at least one lowercase letter'); } if (!/\d/.test(password)) { errors.push('Password must contain at least one number'); } if (!/[!@#$%^&*(),.?":{}|<>]/.test(password)) { errors.push('Password must contain at least one special character'); } return { isValid: errors.length === 0, errors, }; } static createSecureUserSchema() { return z.object({ email: z.string() .email('Invalid email format') .max(254, 'Email too long') .transform(this.sanitizeInput), name: z.string() .min(1, 'Name is required') .max(100, 'Name too long') .transform(this.sanitizeInput), password: z.string() .min(8, 'Password too short') .max(128, 'Password too long') .refine((password) => this.validatePassword(password).isValid, { message: 'Password does not meet security requirements', }), }); } } ``` ### API Security Tests ```typescript // __tests__/security/api-security.test.ts import { createMocks } from 'node-mocks-http'; import { POST } from '@/app/api/users/route'; describe('API Security Tests', () => { describe('Input Validation', () => { it('should reject XSS attempts in user input', async () => { const maliciousPayload = { email: 'test@example.com', name: '', }; const { req } = createMocks({ method: 'POST', body: maliciousPayload, }); const response = await POST(req); // Should either sanitize or reject the input expect([200, 400]).toContain(response.status); if (response.status === 200) { const data = await response.json(); expect(data.data.name).not.toContain('

Security Scanning

Install this skill

Comments