Security Review

PRs with security implications require:

Review from security team member
All security tests passing
No new vulnerabilities introduced
Documentation of security changes `;
```
  await fs.writeFile(
      path.join(this.projectRoot, 'CONTRIBUTING.md'),
      contributing
  );
  
  console.log('✓ Security policies created');
```
}
async setupCICD() { // GitHub Actions workflow const githubWorkflow = { name: 'Security Checks', on: { push: { branches: ['main', 'develop'] }, pull_request: { branches: ['main'] }, schedule: [ { cron: '0 0 * * MON' } // Weekly security scan ] }, jobs: { security: { 'runs-on': 'ubuntu-latest', strategy: { matrix: { 'node-version': ['16.x', '18.x', '20.x'] } }, steps: [ { name: 'Checkout', uses: 'actions/checkout@v3', with: { 'fetch-depth': 0 // Full history for better analysis } }, { name: 'Setup Node.js', uses: 'actions/setup-node@v3', with: { 'node-version': '${{ matrix.node-version }}', 'cache': 'npm' } }, { name: 'Install dependencies', run: 'npm ci' }, { name: 'Run ESLint Security', run: 'npm run lint:security', 'continue-on-error': true }, { name: 'Run npm audit', run: 'npm audit --production --audit-level=moderate' }, { name: 'Run Snyk Security Scan', uses: 'snyk/actions/node@master', env: { SNYK_TOKEN: '${{ secrets.SNYK_TOKEN }}' }, with: { args: '--severity-threshold=medium' } }, { name: 'Run OWASP Dependency Check', uses: 'dependency-check/Dependency-Check_Action@main', with: { project: 'MyProject', path: '.', format: 'HTML', args: '--enableRetired --enableExperimental' } }, { name: 'Run Security Tests', run: 'npm run test:security -- --coverage', env: { NODE_ENV: 'test' } }, { name: 'SonarCloud Scan', uses: 'SonarSource/sonarcloud-github-action@master', env: { GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}', SONAR_TOKEN: '${{ secrets.SONAR_TOKEN }}' } }, { name: 'Upload Security Reports', uses: 'actions/upload-artifact@v3', if: 'always()', with: { name: 'security-reports', path: | 'dependency-check-report.html', 'coverage/lcov-report', 'audit-report.json' } } ] }, 'container-security': { 'runs-on': 'ubuntu-latest', if: "contains(github.event.head_commit.message, '[docker]')", steps: [ { name: 'Checkout', uses: 'actions/checkout@v3' }, { name: 'Build Docker Image', run: 'docker build -t myapp:${{ github.sha }} .' }, { name: 'Run Trivy vulnerability scanner', uses: 'aquasecurity/trivy-action@master', with: { 'image-ref': 'myapp:${{ github.sha }}', 'format': 'sarif', 'output': 'trivy-results.sarif', 'severity': 'CRITICAL,HIGH' } }, { name: 'Upload Trivy scan results', uses: 'github/codeql-action/upload-sarif@v2', with: { 'sarif_file': 'trivy-results.sarif' } }, { name: 'Run Hadolint', uses: 'hadolint/[email protected]', with: { dockerfile: 'Dockerfile', 'failure-threshold': 'warning' } } ] } } };
// Create .github/workflows directory const workflowDir = path.join(this.projectRoot, '.github', 'workflows'); await fs.mkdir(workflowDir, { recursive: true });
await fs.writeFile( path.join(workflowDir, 'security.yml'), yaml.dump(githubWorkflow) );
console.log('✓ CI/CD security pipeline configured'); }

}

// Initialize secure development environment async function initializeSecureEnvironment(projectRoot) { const env = new SecureDevEnvironment(projectRoot);

console.log('Setting up secure development environment...\n');

await env.setupPreCommitHooks();
await env.configureESLintSecurity();
await env.setupSecretScanning();
await env.createSecurityPolicies();
await env.setupCICD();

console.log('\n✓ Secure development environment setup complete!');
console.log('\nNext steps:');
console.log('1. Run: npm install');
console.log('2. Run: npm run security:check');
console.log('3. Commit changes to enable security hooks');

}

module.exports = { SecureDevEnvironment, initializeSecureEnvironment };


Integrating security into the development workflow transforms security from a checkpoint to a continuous process. By implementing security tools, automating security checks, and fostering a security-first culture, development teams can build more secure applications while maintaining productivity. The key is making security practices seamless and integrated, so they become a natural part of how teams build software.## Real-World Security Implementation Examples

Understanding security concepts is important, but seeing how they apply in real-world scenarios brings these practices to life. This chapter presents comprehensive examples of secure implementations for common application features, demonstrating how to apply the security principles and patterns discussed throughout this guide. Each example shows both vulnerable and secure implementations, explaining the security decisions made and their impact on the overall application security posture.