pact-security-patterns

Authentication and authorization patterns in this Skill cover JWT, OAuth, and MFA decision trees aligned with OWASP Top 10. Start by reviewing your API design to select the right pattern—JWT for stateless services, OAuth for delegated access—then apply secure defaults like MFA and proper credential storage.

Input validation patterns provide practical checklists and threat-modeling guidance to catch SQL injection, XSS, and command injection during design and code review. Apply validation at entry points, use parameterized queries, and follow the included security testing checklist.

Secrets management patterns guide encryption, key rotation, and secure storage across Prepare, Plan, and Test phases. This Skill includes decision trees for when to encrypt, how to rotate keys, and logging practices that don't expose sensitive data.

Yes. This Skill integrates threat modeling and security testing checklists aligned with OWASP Top 10. Request a security plan for your API design to generate a threat model, testing checklist, and phase-by-phase controls.

OWASP Top 10 coverage means this Skill maps the ten most critical web application vulnerabilities—injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, XSS, insecure deserialization, using components with known vulnerabilities, and insufficient logging—to practical patterns and checklists.

Security patterns include code review checklists and testing guidelines for each PACT phase. Use them to verify authentication logic, validate input handling, confirm secrets are not logged, and ensure authorization decisions are enforced consistently.