Security Expert | Bootspring Docs

The Security Expert agent specializes in application security, authentication, and protecting against vulnerabilities.

Expertise Areas#

Authentication - JWT, OAuth 2.0, SAML, passwordless
Authorization - RBAC, ABAC, permissions
OWASP Top 10 - XSS, CSRF, injection, etc.
Encryption - At rest, in transit, key management
Security Headers - CSP, HSTS, X-Frame-Options
API Security - Rate limiting, API keys, scopes
Compliance - GDPR, HIPAA, SOC 2

Usage Examples#

Security Audit#

Use the security-expert agent to review this authentication code for vulnerabilities.

Response includes:

Vulnerability identification
Risk assessment
Remediation steps
Best practice recommendations

Auth Implementation#

Use the security-expert agent to implement OAuth 2.0 with PKCE for a SPA.

Response includes:

Flow implementation
Token handling
Security considerations
Error handling

Input Validation#

Use the security-expert agent to create a secure input validation layer.

Response includes:

Validation schemas
Sanitization functions
Error messages
Edge case handling

OWASP Top 10 Coverage#

1. Injection#

SQL injection prevention
NoSQL injection
Command injection
LDAP injection

2. Broken Authentication#

Secure session management
Password policies
MFA implementation
Brute force protection

3. Sensitive Data Exposure#

Encryption at rest
TLS configuration
Data masking
Secure key storage

4. XML External Entities (XXE)#

Parser configuration
Input validation
Entity expansion limits

5. Broken Access Control#

Authorization checks
IDOR prevention
Privilege escalation
Directory traversal

6. Security Misconfiguration#

Default credentials
Error handling
Security headers
Unnecessary features

7. Cross-Site Scripting (XSS)#

Output encoding
CSP headers
DOM sanitization
Template escaping

8. Insecure Deserialization#

Input validation
Integrity checks
Type checking
Allowlists

9. Using Components with Known Vulnerabilities#

Dependency scanning
Version management
Security advisories
Update strategies

10. Insufficient Logging & Monitoring#

Audit logging
Alerting
Incident response
Log protection

Security Patterns#

Authentication Middleware#

// Secure JWT verification
import { verify } from 'jsonwebtoken';

export const authenticate = async (req, res, next) => {
  try {
    const token = req.headers.authorization?.replace('Bearer ', '');

    if (!token) {
      throw new UnauthorizedError('No token provided');
    }

    // Verify with algorithm restriction
    const payload = verify(token, process.env.JWT_SECRET, {
      algorithms: ['HS256'],
      issuer: 'your-app',
      audience: 'your-api',
    });

    // Check token blacklist (for logout)
    const isBlacklisted = await redis.get(`blacklist:${token}`);
    if (isBlacklisted) {
      throw new UnauthorizedError('Token revoked');
    }

    req.user = payload;
    next();
  } catch (error) {
    next(new UnauthorizedError('Invalid token'));
  }
};

Password Hashing#

import { hash, compare } from 'bcrypt';

const SALT_ROUNDS = 12;

export async function hashPassword(password: string): Promise<string> {
  // Validate password strength first
  if (!isStrongPassword(password)) {
    throw new ValidationError('Password does not meet requirements');
  }
  return hash(password, SALT_ROUNDS);
}

export async function verifyPassword(
  password: string,
  hashedPassword: string
): Promise<boolean> {
  return compare(password, hashedPassword);
}

Security Headers#

// Helmet configuration
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'strict-dynamic'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'", "https://api.example.com"],
      fontSrc: ["'self'"],
      objectSrc: ["'none'"],
      frameAncestors: ["'none'"],
      upgradeInsecureRequests: [],
    },
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true,
  },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
}));

Rate Limiting#

import rateLimit from 'express-rate-limit';
import RedisStore from 'rate-limit-redis';

// General API rate limit
export const apiLimiter = rateLimit({
  store: new RedisStore({ client: redisClient }),
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  message: { error: 'Too many requests' },
  standardHeaders: true,
  legacyHeaders: false,
});

// Strict limit for auth endpoints
export const authLimiter = rateLimit({
  store: new RedisStore({ client: redisClient }),
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 5,
  message: { error: 'Too many login attempts' },
  skipSuccessfulRequests: true,
});

Sample Prompts#

Task	Prompt
Security audit	"Review this code for security vulnerabilities"
Auth system	"Implement secure password reset flow"
API security	"Add API key authentication with rate limiting"
Data protection	"Encrypt sensitive user data at rest"
CORS setup	"Configure CORS for a production SPA"

Security Checklist#

The Security Expert can generate checklists for:

Authentication security
Authorization controls
Input validation
Output encoding
Error handling
Logging and monitoring
Dependency security
Infrastructure security
Data protection
Session management

Configuration#

// bootspring.config.js
module.exports = {
  agents: {
    customInstructions: {
      'security-expert': `
        - Follow OWASP guidelines
        - Assume all input is malicious
        - Use principle of least privilege
        - Implement defense in depth
        - Log security events
      `,
    },
  },
  quality: {
    gates: ['security'],
    security: {
      checks: ['dependencies', 'secrets', 'owasp'],
    },
  },
};

Backend Expert - Server security
DevOps Expert - Infrastructure security
API Expert - API security patterns