Prompt file imported from arcmoonstudios/rust-ez (.github/prompts/security-api.prompt.md). Copyright stays with the author.

Secure REST API Review Protocol - Enterprise Security Framework

Core Security Directives

• Implement comprehensive security verification with multi-layer analysis
• Apply OWASP ASVS 4.0 Level 3 compliance verification
• Execute threat modeling with STRIDE/DREAD methodology
• Implement security control verification with evidence-based assessment
• Apply zero-trust architecture validation with security boundary analysis

Security Assessment Dimensions

Authentication Implementation

• Verify OAuth2/OIDC implementation with RFC compliance
• Analyze JWT validation with cryptographic verification
• Verify multi-factor authentication implementation
• Analyze credential storage with encryption validation
• Verify session management with secure cookie implementation
• Analyze brute force protection with rate limiting controls
• Verify password policy compliance with NIST guidance
• Analyze authentication bypass vectors with attack simulation

Authorization Controls

• Verify role-based access control implementation
• Analyze attribute-based access control with policy validation
• Verify resource authorization with permission verification
• Analyze privilege escalation vectors with attack paths
• Verify authorization bypass protection with security boundaries
• Analyze horizontal privilege escalation vectors
• Verify least privilege implementation with role analysis
• Analyze delegation mechanisms with security controls

Data Protection

• Verify transport layer security with TLS configuration
• Analyze data-at-rest encryption with key management
• Verify PII/sensitive data handling with privacy controls
• Analyze data minimization practices with scope verification
• Verify secure deserialization with input validation
• Analyze data leakage vectors with information flow analysis
• Verify backup security with encryption verification
• Analyze data retention with compliance verification

Input Validation

• Verify parameter validation with type checking
• Analyze injection prevention with context-aware escaping
• Verify schema validation with structural verification
• Analyze XSS prevention with output encoding
• Verify upload validation with file type verification
• Analyze request forgery protection with origin validation
• Verify business logic validation with constraint enforcement
• Analyze deserialization controls with type safety

API Security Controls

• Verify rate limiting with abuse prevention
• Analyze API versioning with deprecation management
• Verify CORS configuration with origin validation
• Analyze API documentation with security guidance
• Verify error handling with information disclosure prevention
• Analyze logging implementation with sensitive data masking
• Verify health check security with authentication controls
• Analyze dependency security with vulnerability scanning

Operational Security

• Verify logging implementation with forensic completeness
• Analyze monitoring controls with alert configuration
• Verify incident response integration with SIEM
• Analyze deployment security with infrastructure validation
• Verify container security with image scanning
• Analyze secrets management with vault integration
• Verify SBOM generation with vulnerability tracking
• Analyze compliance requirements with control mapping

Security Assessment Protocol

Phase 1: Documentation Analysis

1. API Specification Review:

   • Analyze OpenAPI/Swagger documentation
   • Verify security control documentation
   • Review authentication/authorization flows
   • Analyze error handling specifications
   • Verify rate limiting documentation

2. Architecture Review:

   • Analyze system architecture
   • Verify trust boundaries
   • Review data flow diagrams
   • Analyze dependency relationships
   • Verify deployment architecture

Phase 2: Threat Modeling

1. Asset Identification:

   • Identify sensitive data assets
   • Verify data classification
   • Review business critical functions
   • Analyze regulatory requirements
   • Verify security boundaries

2. Threat Analysis:

   • Apply STRIDE methodology
   • Verify attack vectors
   • Review attack trees
   • Analyze threat scenarios
   • Verify threat prioritization

3. Risk Assessment:

   • Apply DREAD scoring
   • Verify risk levels
   • Review risk acceptance criteria
   • Analyze remediation priorities
   • Verify risk management approach

Phase 3: Static Analysis

1. Code Review:

   • Analyze authentication implementation
   • Verify authorization controls
   • Review input validation
   • Analyze error handling
   • Verify logging implementation

2. Configuration Review:

   • Analyze TLS configuration
   • Verify CORS settings
   • Review dependency versions
   • Analyze deployment configuration
   • Verify environment settings

Phase 4: Dynamic Analysis

1. Authentication Testing:

   • Verify login functionality
   • Test MFA implementation
   • Review session management
   • Analyze credential handling
   • Verify authentication bypass protections

2. Authorization Testing:

   • Test RBAC implementation
   • Verify resource access controls
   • Review privilege escalation vectors
   • Analyze cross-tenant isolation
   • Verify horizontal access controls

3. Input Validation Testing:

   • Test injection vulnerabilities
   • Verify XSS protections
   • Review CSRF mitigations
   • Analyze file upload security
   • Verify business logic validation

4. API Security Testing:

   • Test rate limiting
   • Verify error handling
   • Review information disclosure
   • Analyze request forgery
   • Verify API versioning

Security Findings Format

For each identified vulnerability:

```

[SEVERITY] - [VULNERABILITY TYPE]

CWE: CWE-XXX CVSS Score: [X.X] (Vector String) Location: [API Endpoint/Component]

Description

[Detailed description of the vulnerability]

Impact

[Explanation of the security impact]

Reproduction Steps

1. [Step-by-step reproduction]
2. [With specific payloads/requests]

Remediation

```typescript // Vulnerable implementation function validateInput(input: string): boolean { return input.length > 0; }

// Secure implementation function validateInput(input: string): boolean { return input.length > 0 && /^[a-zA-Z0-9-_]+$/.test(input) && input.length <= 255; } ```

Verification

[How to verify the fix is properly implemented] ```

Security Assessment Matrix

QA Certification

Security assessment must achieve Elite Level certification:

• OWASP ASVS 4.0 Level 3: ≥95%
• NIST 800-53 Controls: ≥90%
• CIS Critical Controls: ≥95%
• PCI DSS (if applicable): 100%
• GDPR/Privacy Controls (if applicable): ≥95%
• SOC 2 Controls (if applicable): ≥95%