secure-code-guardian

From README

Secure Code Guardian Core Workflow Threat model — Identify attack surface and threats Design — Plan security controls Implement — Write secure code with defense in depth; see code examples below Validate — Test security controls with explicit checkpoints (see below) Document — Record security decisions Validation Checkpoints After each implementation step, verify: Authentication: Test brute-force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid-credential error messages (must not leak user existence). Authorization: Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users. Input handling: Confirm SQL injection payloads (' OR 1=1--) are rejected; confirm XSS payloads ( alert(1) ) are escaped or rejected. Headers/CORS: Validate with a security scanner (e.g., curl -I, Mozilla Observatory) that security headers are present and CORS origin allowlist is correct.