Merge pull request #29 from wendev27/checkpoint-19-owasp-security-practices

docs(checkpoint): complete checkpoint 19 - OWASP security practices

Author: wendev27

README.md

@@ -76,8 +76,8 @@ This repository was created to:
 - [x] Trivy Container Scanning
 - [x] Container Security
 - [x] Secure CI/CD Pipelines
-- [ ] Branch Protection
-- [ ] OWASP Security Practices
+- [x] Branch Protection
+- [x] OWASP Security Practices
 
 ---
 

checkpoints/checkpoint-19-owasp-security-practices.md

@@ -0,0 +1,271 @@
+# 🛡️ Checkpoint 19 — OWASP Security Practices
+
+## 🎯 Objective
+
+Understand how OWASP security principles connect to modern DevSecOps tools and workflows.
+
+This checkpoint focused on answering an important question:
+
+> "How do real-world security risks connect to the tools used in modern CI/CD pipelines?"
+
+To answer that question, I explored:
+
+- OWASP Top 10 risks
+- Secrets management
+- Dependency scanning
+- Static Application Security Testing (SAST)
+- Container security
+- Secure CI/CD pipelines
+- Branch protection rules
+
+---
+
+# 📚 What I Learned
+
+OWASP is not a tool.
+
+OWASP is a collection of security risks, best practices, and guidelines that help developers build secure applications.
+
+Many of the tools and practices explored throughout Phase 4 exist to mitigate OWASP risks.
+
+---
+
+# 🔥 OWASP Risks and Their DevSecOps Counterparts
+
+| OWASP Risk                  | Tool / Practice                        |
+| :-------------------------- | :------------------------------------- |
+| Injection                   | Semgrep, CodeQL, Parameterized Queries |
+| Sensitive Data Exposure     | `.env`, GitHub Secrets                 |
+| Vulnerable Components       | `npm audit`, Trivy                     |
+| Security Misconfiguration   | Branch Protection, CI/CD               |
+| Broken Access Control       | RBAC                                   |
+| Software Integrity Failures | CodeQL, Secure Pipelines               |
+| Denial of Service (DoS)     | Rate Limiting                          |
+
+---
+
+# 🧪 Labs and Experiments
+
+## Environment Variables and Secrets
+
+Created:
+
+```text
+labs/security/secrets-lab/
+```
+
+Practiced:
+
+- Storing secrets inside `.env`
+- Preventing secret leaks using `.gitignore`
+- Using GitHub Secrets inside workflows
+
+---
+
+## Dependency Scanning
+
+Commands:
+
+```bash
+npm audit
+npm audit fix
+```
+
+Experiment:
+
+- Installed an old version of `lodash`
+- Observed HIGH severity vulnerabilities
+- Learned the risks of forced updates
+
+---
+
+## SAST (Static Application Security Testing)
+
+Tool:
+
+```bash
+semgrep
+```
+
+Practiced:
+
+- Detecting insecure code patterns
+- Understanding static analysis
+
+---
+
+## CodeQL
+
+Integrated GitHub CodeQL scanning.
+
+Observed:
+
+- Detection of clear-text logging
+- Detection of SQL Injection risks
+- Detection of missing rate limiting on database endpoints
+- Security findings inside the GitHub Security tab
+
+Learned:
+
+- Secure code is not only about preventing SQL Injection.
+- Security tools analyze data flow between application components.
+- API endpoints that access databases should implement rate limiting.
+- Security also includes protecting application availability.
+
+---
+
+## OWASP Practice: SQL Injection and Rate Limiting
+
+Created:
+
+```text
+labs/security/owasp-lab/
+```
+
+Practiced:
+
+- Writing intentionally vulnerable SQL queries
+- Detecting SQL Injection using CodeQL
+- Fixing vulnerabilities using parameterized queries
+- Protecting endpoints with `express-rate-limit`
+
+Vulnerable query:
+
+```javascript
+const sql = `SELECT * FROM users WHERE name = '${query}'`;
+```
+
+Secure query:
+
+```javascript
+const [rows] = await db.execute('SELECT * FROM users WHERE name = ?', [query]);
+```
+
+Added rate limiting:
+
+```javascript
+const rateLimit = require('express-rate-limit');
+
+const limiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 100,
+});
+
+app.use(limiter);
+```
+
+Learned:
+
+- User input should never be directly concatenated into SQL queries.
+- Databases should receive queries and parameters separately.
+- Public endpoints should implement rate limiting to prevent denial-of-service attacks.
+
+---
+
+## Trivy Container Scanning
+
+Commands:
+
+```bash
+trivy image my-first-image
+
+trivy image node:24-slim
+```
+
+Learned:
+
+- Containers inherit vulnerabilities from their base images.
+- Smaller images reduce the attack surface.
+- Security is not only about application code.
+
+---
+
+## Secure CI/CD
+
+Integrated Trivy into GitHub Actions:
+
+```yaml
+- name: Scan Docker image with Trivy
+  uses: aquasecurity/trivy-action@master
+```
+
+Configured:
+
+```yaml
+severity: CRITICAL
+exit-code: 1
+```
+
+Result:
+
+- The pipeline automatically failed when critical vulnerabilities were detected.
+
+---
+
+## Branch Protection Rules
+
+Learned how GitHub can enforce security policies by requiring:
+
+- Pull requests
+- Passing CI checks
+- CodeQL scans
+- Trivy scans
+
+---
+
+# 🧠 Key Insights
+
+Security is not a single tool.
+
+Modern DevSecOps combines:
+
+```text
+Developer
+    ↓
+Secrets Management
+    ↓
+Dependency Scanning
+    ↓
+SAST
+    ↓
+CodeQL
+    ↓
+Container Security
+    ↓
+Secure CI/CD
+    ↓
+Branch Protection
+    ↓
+Deployment
+```
+
+OWASP provides the security model that connects all of these layers.
+
+---
+
+# 💭 Reflection
+
+Before this checkpoint, I viewed security as individual tools and isolated vulnerabilities.
+
+After completing Phase 4, I understand that modern application security is a chain of defenses that protects code before it reaches production.
+
+I also learned that security is not limited to preventing SQL Injection or protecting secrets. Modern applications must also defend against denial-of-service attacks, insecure dependencies, vulnerable containers, and unsafe deployment pipelines.
+
+---
+
+# 🚀 Phase 4 Complete
+
+Completed:
+
+- ✅ Environment Variables & Secrets Management
+- ✅ Dependency Scanning
+- ✅ SAST
+- ✅ CodeQL
+- ✅ Trivy Container Scanning
+- ✅ Container Security
+- ✅ Secure CI/CD Pipelines
+- ✅ OWASP Security Practices
+
+The next step is:
+
+🌐 **Phase 5 — Infrastructure**