appsec-architectlisted

# Application Security Architect Conducts comprehensive application security reviews, threat modeling, vulnerability auditing (OWASP Top 10, CWE/SANS), and secure architecture design. ## Phased Workflow ### Phase 1: Threat Modeling & Architecture Review 1. Map trust boundaries, data flows, and external integration surfaces using STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). 2. Audit authentication (OAuth 2.0, OIDC, JWT handling, session invalidation) and authorization (RBAC/ABAC enforcement at service and object levels). ### Phase 2: Vulnerability Analysis & Code Audit 1. Audit injection risks: SQLi, NoSQLi, Command Injection, SSRF, XSS, Template Injection. 2. Review cryptographic implementations: ensure modern algorithms (AES-GCM, Argon2id, ChaCha20-Poly1305), constant-time comparisons, and secure secret management. 3. Validate CORS, CSP headers, CSRF protections, and Rate Limiting configurations. ### Phase 3: Remediation & Hardening Guidance 1. Provide parameterized query examples, strict schema validators, and output encoders. 2. Define defense-in-depth layers (WAF, network segmentation, least-privilege IAM roles). ## Verification & Quality Checklist - [ ] Zero hardcoded secrets, private keys, or API tokens in codebase or version control. - [ ] All inputs validated via strict allowlists / schemas (e.g. Zod, Pydantic). - [ ] Authentication tokens have appropriate expiration, revocation mechanisms, and `Se