arogyareddy/alirezarezvani-claude-skills/senior-secops

# Scan project for security issues
python scripts/security_scanner.py /path/to/project
 
# Filter by severity
python scripts/security_scanner.py /path/to/project --severity high
 
# JSON output for CI/CD
python scripts/security_scanner.py /path/to/project --json --output report.json

# Assess project dependencies
python scripts/vulnerability_assessor.py /path/to/project
 
# Critical/high only
python scripts/vulnerability_assessor.py /path/to/project --severity high
 
# Export vulnerability report
python scripts/vulnerability_assessor.py /path/to/project --json --output vulns.json

# Check all frameworks
python scripts/compliance_checker.py /path/to/project
 
# Specific framework
python scripts/compliance_checker.py /path/to/project --framework soc2
python scripts/compliance_checker.py /path/to/project --framework pci-dss
python scripts/compliance_checker.py /path/to/project --framework hipaa
python scripts/compliance_checker.py /path/to/project --framework gdpr
 
# Export compliance report
python scripts/compliance_checker.py /path/to/project --json --output compliance.json

# Step 1: Scan for code vulnerabilities
python scripts/security_scanner.py . --severity medium
# STOP if exit code 2 — resolve critical findings before continuing

# Step 2: Check dependency vulnerabilities
python scripts/vulnerability_assessor.py . --severity high
# STOP if exit code 2 — patch critical CVEs before continuing

# Step 3: Verify compliance controls
python scripts/compliance_checker.py . --framework all
# STOP if exit code 2 — address critical gaps before proceeding

# Step 4: Generate combined reports
python scripts/security_scanner.py . --json --output security.json
python scripts/vulnerability_assessor.py . --json --output vulns.json
python scripts/compliance_checker.py . --json --output compliance.json

# .github/workflows/security.yml
name: "security-scan"
 
on:
  pull_request:
    branches: [main, develop]
 
jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: "set-up-python"
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
 
      - name: "security-scanner"
        run: python scripts/security_scanner.py . --severity high
 
      - name: "vulnerability-assessment"
        run: python scripts/vulnerability_assessor.py . --severity critical
 
      - name: "compliance-check"
        run: python scripts/compliance_checker.py . --framework soc2

1. ASSESS (0-2 hours)
   - Identify affected systems using vulnerability_assessor.py
   - Check if CVE is being actively exploited
   - Determine CVSS environmental score for your context
   - STOP if CVSS 9.0+ on internet-facing system — escalate immediately
 
2. PRIORITIZE
   - Critical (CVSS 9.0+, internet-facing): 24 hours
   - High (CVSS 7.0-8.9): 7 days
   - Medium (CVSS 4.0-6.9): 30 days
   - Low (CVSS < 4.0): 90 days
 
3. REMEDIATE
   - Update affected dependency to fixed version
   - Run security_scanner.py to verify fix (must return exit code 0)
   - STOP if scanner still flags the CVE — do not deploy
   - Test for regressions
   - Deploy with enhanced monitoring
 
4. VERIFY
   - Re-run vulnerability_assessor.py
   - Confirm CVE no longer reported
   - Document remediation actions

PHASE 1: DETECT & IDENTIFY (0-15 min)
- Alert received and acknowledged
- Initial severity assessment (SEV-1 to SEV-4)
- Incident commander assigned
- Communication channel established
 
PHASE 2: CONTAIN (15-60 min)
- Affected systems identified
- Network isolation if needed
- Credentials rotated if compromised
- Preserve evidence (logs, memory dumps)
 
PHASE 3: ERADICATE (1-4 hours)
- Root cause identified
- Malware/backdoors removed
- Vulnerabilities patched (run security_scanner.py; must return exit code 0)
- Systems hardened
 
PHASE 4: RECOVER (4-24 hours)
- Systems restored from clean backup
- Services brought back online
- Enhanced monitoring enabled
- User access restored
 
PHASE 5: POST-INCIDENT (24-72 hours)
- Incident timeline documented
- Root cause analysis complete
- Lessons learned documented
- Preventive measures implemented
- Stakeholder report delivered

## Input Validation
-[ ] Validate all input on server side
-[ ] Use allowlists over denylists
-[ ] Sanitize for specific context (HTML, SQL, shell)
 
## Output Encoding
-[ ] HTML encode for browser output
-[ ] URL encode for URLs
-[ ] JavaScript encode for script contexts
 
## Authentication
-[ ] Use bcrypt/argon2 for passwords
-[ ] Implement MFA for sensitive operations
-[ ] Enforce strong password policy
 
## Session Management
-[ ] Generate secure random session IDs
-[ ] Set HttpOnly, Secure, SameSite flags
-[ ] Implement session timeout (15 min idle)
 
## Error Handling
-[ ] Log errors with context (no secrets)
-[ ] Return generic messages to users
-[ ] Never expose stack traces in production
 
## Secrets Management
-[ ] Use environment variables or secrets manager
-[ ] Never commit secrets to version control
-[ ] Rotate credentials regularly

# BAD: Hardcoded secret
API_KEY = "sk-1234567890abcdef"
# GOOD: Environment variable
import os
API_KEY = os.environ.get("API_KEY")
# BETTER: Secrets manager
from your_vault_client import get_secret
API_KEY = get_secret("api/key")

# BAD: String concatenation
query = f"SELECT * FROM users WHERE id = {user_id}"
# GOOD: Parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

// BAD: Direct innerHTML assignment is vulnerable
// GOOD: Use textContent (auto-escaped)
element.textContent = userInput;
// GOOD: Use sanitization library for HTML
import DOMPurify from 'dompurify';
const safeHTML = DOMPurify.sanitize(userInput);

// Password hashing
const bcrypt = require('bcrypt');
const SALT_ROUNDS = 12;
// Hash password
const hash = await bcrypt.hash(password, SALT_ROUNDS);
// Verify password
const match = await bcrypt.compare(password, hash);

// Express.js security headers
const helmet = require('helmet');
app.use(helmet());
// Or manually set headers:
app.use((req, res, next) => {
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('X-XSS-Protection', '1; mode=block');
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  res.setHeader('Content-Security-Policy', "default-src 'self'");
  next();
});