moai-domain-security

OWASP Top 10 protection involves embedding security middleware and practices into your application to defend against common vulnerabilities like injection and broken access control. This skill provides production-ready patterns for authentication, input validation, and authorization that address the most critical web security risks and reduce your attack surface.

Zero-trust architecture verifies every access request dynamically based on context rather than trusting network perimeter. It implements context-aware authentication and authorization controls that continuously validate users and services. This approach minimizes attack surface by assuming no implicit trust, even for internal requests.

STRIDE and PASTA are structured threat modeling frameworks that systematically identify and categorize risks early in development. This skill guides you through threat analysis to uncover vulnerabilities in architecture and design, enabling risk mitigation before code is written and shifting security left in your development cycle.

DevSecOps automation embeds SAST, DAST, and dependency vulnerability scans directly into CI/CD pipelines for continuous security assurance. This skill provides patterns to integrate bandit, safety, and Docker security checks so vulnerabilities are caught automatically without manual review delays.

Yes. This skill implements IAM controls, cryptography primitives, and security governance patterns aligned with SOC 2, ISO 27001, and GDPR requirements. It automates compliance-relevant controls across authentication, data protection, and audit logging to simplify compliance governance and reduce audit friction.

This skill applies to Flask-based applications and uses Python security libraries like jwt, secrets, bandit, and safety. It supports Docker containerization and works with enterprise Python environments, though the threat modeling and DevSecOps patterns generalize across language stacks and cloud platforms.