securitylisted

# Security Patterns Domain expertise for security vulnerability detection. Use alongside `devflow:review-methodology` for complete security reviews. ## Iron Law > **ASSUME ALL INPUT IS MALICIOUS** > > Every user input, URL parameter, header, and cookie is an attack vector. Use parameterized > queries always. Escape output always. Validate schemas always. "This field is internal" > is not a defense. Defense in depth, not wishful thinking. [1][6] ## Vulnerability Categories ### 1. Input Validation & Injection [1][6] **SQL Injection** — parameterize, never interpolate: ```typescript // VULNERABLE: const query = `SELECT * FROM users WHERE email = '${email}'`; await db.execute("SELECT * FROM users WHERE email = ?", [email]); ``` **XSS** — text content, never innerHTML: ```typescript element.textContent = userInput; // not: element.innerHTML = userInput ``` > `references/patterns.md` — NoSQL, command injection, path traversal, LDAP injection. ### 2. Authentication & Authorization [1][2][7] ```typescript // VULNERABLE: no auth middleware app.delete('/api/users/:id', async (req, res) => { await deleteUser(req.params.id); }); // SECURE: layered auth app.delete('/api/users/:id', requireAuth, requireRole('admin'), handler); ``` NIST 800-63 minimum: 15-char passphrase or 12-char complex, phishing-resistant MFA [7]. JWT: pin algorithm explicitly, set `expiresIn`, store refresh tokens server-side [17]. ### 3. Cryptography & Secrets [5][24][25] ```typescript const API_KEY = p