appsec-patternslisted

# Application Security Patterns ## Secure SDLC Integration ``` Phase 1 — Requirements: ✓ Security user stories in backlog ✓ Abuse cases alongside use cases ✓ Compliance requirements identified (GDPR, HIPAA, PCI) ✓ Data classification for each feature Phase 2 — Design: ✓ Threat model created (STRIDE) ✓ Security architecture review ✓ Data flow diagrams with trust boundaries Phase 3 — Development: ✓ Secure coding guidelines enforced ✓ SAST in IDE (Semgrep, SonarLint) ✓ Pre-commit hooks: secrets scan, lint Phase 4 — Testing: ✓ SAST in CI pipeline ✓ Dependency audit (pip-audit, npm audit) ✓ DAST on staging (OWASP ZAP, Burp) ✓ Security regression tests Phase 5 — Deployment: ✓ Container image scanning ✓ Infrastructure as Code security scan (tfsec, checkov) ✓ Secret rotation before release Phase 6 — Operations: ✓ Runtime security monitoring ✓ Vulnerability disclosure process ✓ Incident response playbook ``` ## Security User Stories ``` Feature: User Authentication Security Story 1: AS a security engineer I WANT passwords hashed with argon2id SO THAT a database breach doesn't expose credentials Acceptance Criteria: - Password stored as argon2id hash (m=65536, t=3, p=4) - Plaintext never logged - Hash verified in constant time Abuse Case: An attacker with DB dump cannot crack passwords within 1 year on consumer GPU hardware ``` ## Security Requirements Template ```yaml # security-requirements.yaml authentication: m