Security & Testing

Security Principles

1. Defense in Depth: Multiple layers of security
2. Least Privilege: Minimum necessary permissions
3. Fail Secure: Default to deny
4. Zero Trust: Never trust, always verify

OWASP Top 10 Quick Reference

#	Vulnerability	Prevention
1	Broken Access Control	RBAC, deny by default, audit logs
2	Cryptographic Failures	TLS, strong algorithms, key management
3	Injection	Parameterized queries, input validation
4	Insecure Design	Threat modeling, secure patterns
5	Security Misconfiguration	Hardened defaults, minimal services
6	Vulnerable Components	Dependency scanning, updates
7	Auth/Identity Failures	MFA, session management
8	Software/Data Integrity	Signed artifacts, CI/CD security
9	Logging/Monitoring Failures	Centralized logs, alerting
10	SSRF	Input validation, allowlists

Security Checklist

• No hardcoded secrets
• Secrets not logged
• Input validation on all boundaries
• Parameterized queries
• Dependencies scanned for CVEs
• Authentication & authorization implemented
• HTTPS enforced
• Security headers configured
• Rate limiting in place
• Audit logging enabled

Testing Pyramid

        /\
       /  \     E2E Tests (few)
      /----\
     /      \   Integration Tests
    /--------\
   /          \ Unit Tests (many)
  /------------\

Type	Purpose	Speed	Coverage
Unit	Test isolated logic	Fast	High
Integration	Test component interaction	Medium	Medium
E2E	Test full user flows	Slow	Low

Testing Best Practices

# Arrange-Act-Assert pattern
def test_user_creation():
    # Arrange
    user_data = {"name": "Alice", "email": "alice@acme.com"}
    
    # Act
    user = create_user(user_data)
    
    # Assert
    assert user.name == "Alice"
    assert user.email == "alice@acme.com"

# Test edge cases
def test_empty_input():
    with pytest.raises(ValueError):
        create_user({})

def test_invalid_email():
    with pytest.raises(ValidationError):
        create_user({"name": "Bob", "email": "invalid"})

API Security

# Essential security headers
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains

# Rate limiting
from flask_limiter import Limiter
limiter = Limiter(key_func=get_remote_address)

@app.route("/api/login")
@limiter.limit("5 per minute")
def login():
    pass

Observability

Three Pillars

Pillar	Purpose	Tools
Logs	Event records	ELK, CloudWatch
Metrics	Numerical measurements	Prometheus, DataDog
Traces	Request flows	Jaeger, X-Ray

Structured Logging

logger.info("User action", extra={
    "user_id": user.id,
    "action": "login",
    "ip": request.remote_addr,
    "timestamp": datetime.utcnow().isoformat()
})

Detailed References

• OWASP Security: See references/owasp-security.md
• Testing Strategies: See references/testing-strategies.md
• API Design: See references/api-design.md
• Observability: See references/observability.md