Security9 min read

Application Security

Embed security into every layer of development with OWASP controls, secure headers, input validation, and automated scanning in CI.

securityappsecowaspdevsecops

Application security (AppSec) embeds protective controls throughout the software lifecycle. It covers threat modeling, secure coding, automated scanning, and runtime protection-treating security as a quality attribute, not a bolt-on.

Security is a first-class engineering concern. Shift left: model threats during design, enforce controls in code, automate scanning in CI, and monitor at runtime. Treat every user input as hostile until proven safe.

Workflow

Threat model during designFinding threats early costs 30× less to fix than post-deployment.
Validate and sanitize all inputsInjection (SQL, XSS, command) is consistently the #1 OWASP category.
Set secure HTTP headersHeaders defend against XSS, clickjacking, MIME sniffing, and information leakage at near-zero cost.
Automate SAST and dependency scanning in CIManual reviews miss patterns; automation catches them consistently at scale.
Handle secrets and errors securelyLeaked secrets and verbose errors are top breach vectors.

Output Format

Security controls embedded in code, CI pipeline gates for SAST/DAST/dependency scan, secure headers verified, secrets in vault, threat model documented.

Examples

Parameterized SQL: `db.query("SELECT * FROM users WHERE id = $1", [userId])`

Helmet.js: `app.use(helmet({ contentSecurityPolicy: { directives: { defaultSrc: ["self"], scriptSrc: ["self", (req, res) => `nonce-${res.locals.nonce}`] } } }))`

Input validation: `const schema = z.object({ email: z.string().email(), age: z.number().int().min(0).max(150) }); const data = schema.parse(req.body)`

Edge Cases & Gotchas

CSP breaks inline scripts from third-party widgets-use nonce or hash instead of unsafe-inline
HSTS preload requires 1-year max-age and cannot be undone quickly; test on staging first
Rate-limit authentication endpoints separately from general API to prevent brute-force without breaking UX

When to Break These Rules

Disable strict CSP in development for hot-reload tooling-use environment-specific configs, never weaken production.

Reference Files

OWASP Top 10 2021: https://owasp.org/www-project-top-ten/
OWASP ASVS: https://owasp.org/www-project-application-security-verification-standard/
Helmet.js: https://helmetjs.github.io/
Semgrep rules: https://semgrep.dev/r