/security-mindset — Security Mindset

Think like an attacker. Question trust assumptions. Validate all input.

Core Philosophy

"Security is a process, not a product."

The security mindset means:

1. •Think like an attacker — How would I break this?
2. •Assume breach — What happens when (not if) security fails?
3. •Defense in depth — Multiple layers, no single point of failure
4. •Trust minimization — Give minimum required privileges

Key Principles

1. Threat Modeling

Before writing code, ask:

• •What are we protecting? (Assets)
• •From whom? (Threat actors)
• •What can go wrong? (Attack vectors)
• •What's the impact? (Risk assessment)

2. Attack Surface Reduction

// Bad: Large attack surface
app.use(express.json({ limit: '50mb' }));
app.use('*', handleEverything);

// Good: Minimal surface
app.use(express.json({ limit: '100kb' }));
app.use('/api/v1', rateLimiter, validateInput, apiRoutes);

3. Fail Securely

// Bad: Fails open
try {
    if (user.HasPermission(resource)) return Allow();
} catch { }
return Allow(); // WRONG - fails open

// Good: Fails closed
try {
    if (user.HasPermission(resource)) return Allow();
} catch (Exception ex) {
    Log.Error(ex);
}
return Deny(); // Default deny

4. Trust Nothing from Outside

• •All user input is malicious until validated
• •All external APIs may be compromised
• •All network traffic may be intercepted
• •All client-side controls may be bypassed

Security Questions (Ask Every Review)

1. •Authentication: How do we know who this is?
2. •Authorization: Should they be allowed to do this?
3. •Input validation: What happens with malformed input?
4. •Error handling: Do errors leak information?
5. •Logging: Would we detect an attack?
6. •Data protection: Is sensitive data encrypted?

Common Vulnerabilities to Check

• •Injection (SQL, command, LDAP)
• •Broken authentication
• •Sensitive data exposure
• •XXE (XML External Entities)
• •Broken access control
• •Security misconfiguration
• •XSS (Cross-Site Scripting)
• •Insecure deserialization
• •Using components with known vulnerabilities
• •Insufficient logging/monitoring

Anti-Patterns (Always Reject)

• •Security through obscurity
• •Rolling your own crypto
• •Trusting client-side validation
• •Storing passwords in plaintext or reversible encryption
• •Overly permissive CORS
• •Hardcoded secrets
• •Verbose error messages to users

When to Invoke /security-mindset

• •Designing authentication/authorization
• •Handling sensitive data
• •Processing user input
• •Implementing API endpoints
• •Code reviews for security
• •After any security incident