Security & Testing

Security Principles

1. Defense in Depth: Multiple layers of security
2. Least Privilege: Minimum necessary permissions
3. Fail Secure: Default to deny
4. Zero Trust: Never trust, always verify

OWASP Top 10 Quick Reference

Security Checklist

• No hardcoded secrets
• Secrets not logged
• Input validation on all boundaries
• Parameterized queries
• Dependencies scanned for CVEs
• Authentication & authorization implemented
• HTTPS enforced
• Security headers configured
• Rate limiting in place
• Audit logging enabled

Testing Pyramid

        /\
       /  \     E2E Tests (few)
      /----\
     /      \   Integration Tests
    /--------\
   /          \ Unit Tests (many)
  /------------\

Testing Best Practices

# Arrange-Act-Assert pattern
def test_user_creation():
    # Arrange
    user_data = {"name": "Alice", "email": "alice@acme.com"}
    
    # Act
    user = create_user(user_data)
    
    # Assert
    assert user.name == "Alice"
    assert user.email == "alice@acme.com"

# Test edge cases
def test_empty_input():
    with pytest.raises(ValueError):
        create_user({})

def test_invalid_email():
    with pytest.raises(ValidationError):
        create_user({"name": "Bob", "email": "invalid"})

API Security

# Essential security headers
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains

# Rate limiting
from flask_limiter import Limiter
limiter = Limiter(key_func=get_remote_address)

@app.route("/api/login")
@limiter.limit("5 per minute")
def login():
    pass

Observability

Three Pillars

Structured Logging

logger.info("User action", extra={
    "user_id": user.id,
    "action": "login",
    "ip": request.remote_addr,
    "timestamp": datetime.utcnow().isoformat()
})

Detailed References

• OWASP Security: See references/owasp-security.md
• Testing Strategies: See references/testing-strategies.md
• API Design: See references/api-design.md
• Observability: See references/observability.md