# Security

Resistance to misuse: protecting data and behavior against an adversary. A
distinct discipline with its own literature (OWASP), toolchains (SAST / DAST /
SCA), and tracking infrastructure (CVE, GHSA, [NVD](https://nvd.nist.gov/)). *Safety* is a
different concern: a product not harming people, property, or the environment.
Here it folds into Functionality and Reliability rather than forming a dimension
of its own; the methods are in [verifying safety-critical
systems](https://quality.stereobooster.com/safety.md).

The most cost-effective security work is *removing whole classes of
vulnerability* rather than detecting cases one at a time: memory-safe
languages eliminate buffer overflows, parameterized queries eliminate
SQL injection, framework-level escaping eliminates most XSS.

## What goes wrong

- **Injection.** SQL, OS command, LDAP, XPath, template.
  User input ends up where it shouldn't be parsed.
- **Authentication and session bugs.** Predictable tokens, replay,
  weak credential storage, missing rate limits.
- **Authorization bugs.** A user accessing data that belongs to
  another tenant. Often invisible to the type system; visible to
  fuzzers and pentesters.
- **Cross-site issues.** XSS, CSRF, CORS misconfiguration, mixed
  content. Browser-side trust failures.
- **Supply-chain compromise.** A trusted dependency ships malicious
  or vulnerable code. xz-utils (2024), log4shell (2021),
  SolarWinds (2020).
- **Sensitive data exposure.** Secrets in source control, PII in
  logs, unencrypted transport.
- **Insecure-by-default configuration.** Open S3 buckets, default
  admin passwords, public-by-default API endpoints.
- **Memory safety bugs in unsafe languages.** Buffer overflows,
  use-after-free, double-free. Catastrophic and entirely avoidable
  in a memory-safe language.
- **Algorithmic-complexity denial of service.** A crafted input drives
  a routine into its worst case: regex catastrophic backtracking
  (ReDoS), a quadratic parser, a hash-collision flood. ReDoS is caught
  statically by a
  [linter](https://quality.stereobooster.com/deep-static-analysis.md#redos);
  the general worst case by complexity fuzzing under
  [algorithmic complexity testing](https://quality.stereobooster.com/algorithmic-complexity.md).

## What success looks like

- **CVEs with public exploits do not surprise the team.** SCA
  flagged them, dependencies have been updated or pinned with
  explicit risk acceptance.
- **Threat model exists and is current.** Last reviewed within the
  release cycle; reflects what the system actually does.
- **Security headers and defaults are correct.** A scan with
  securityheaders.com or Mozilla Observatory returns A or A+.
- **[OWASP Top 10](https://owasp.org/www-project-top-ten/) categories are addressed explicitly.**
  Each one named, each one with a control documented.
- **No secrets in source.** Provable via a clean scan.
- **Recovery from compromise is rehearsed.** Backup integrity
  verified, restore tested, blast radius understood.

## Referenced by

- [Quality dimensions](https://quality.stereobooster.com/quality-dimensions.md) · Quality dimensions
- [Algorithmic complexity testing](https://quality.stereobooster.com/algorithmic-complexity.md) · Methods
- [Schema and boundary validation](https://quality.stereobooster.com/schema-and-boundary-validation.md) · Methods
- [Choosing methods](https://quality.stereobooster.com/choosing.md) · Overview

## Acronyms

- CSRF — cross-site request forgery
- DAST — dynamic application security testing
- PII — personally identifiable information
- SAST — static application security testing
- SCA — software composition analysis
- XSS — cross-site scripting