web-application-security
Installation
SKILL.md
Web Application Security
Vulnerability Classes
| Category | Threats |
|---|---|
| Input validation | Command injection, SQL injection, Cross-Site Scripting (XSS) |
| Upload handling | Local File Inclusion (LFI), Remote File Inclusion (RFI) |
| Session management | Man-in-the-Middle (MITM), session fixation, session hijacking |
| Data exposure | Cleartext data theft, insecure storage, cache leaks |
| Authentication | Credential stuffing, brute force, account enumeration |
| Access control | Privilege escalation, IDOR, missing function-level checks |
Security Requirements
Server-Side Controls
All security controls MUST be implemented server-side. Client-side validation is a UX convenience, not a security boundary. This applies to: