Enterprise AppSec Microservices Benchmark & Security Framework

A production-grade, containerized microservices security benchmark engineered to demonstrate multi-tenant data isolation, automated exploit harnesses, shift-left DevSecOps automation, and defense-in-depth remediation against OWASP Top 10 and API Security Top 10 vulnerabilities.

---

📑 Table of Contents

1. Executive Summary
2. System Architecture & Trust Zones
3. Shift-Left CI/CD Security Gates
4. Vulnerability Lifecycle & Remediation Matrix
5. Quickstart & Execution
6. Security Documentation & Threat Modeling
7. Key Security Engineering Highlights

---

🏛️ Executive Summary

Modern cloud-native architectures require rigorous multi-tenant security guarantees, proactive static analysis, and automated exploit regression suites. This repository serves as an end-to-end security benchmark showcasing:

• Decoupled Microservice Mesh: High-throughput Auth Service and Core Resource API with asynchronous SQLAlchemy ORM, PostgreSQL persistence, and Redis caching.
• Multi-Tenant Isolation: Database-level compound predicate scoping and tenant-isolated caching namespaces.
• Hardened Ingress & Egress: Sliding window rate limiting, defensive HTTP response headers, and SSRF/DNS-rebinding protection with socket IP pinning.
• Automated Exploit Harness: Deterministic pytest exploit suite proving exploitability in vulnerable states and regression resistance post-remediation.
• Automated Shift-Left DevSecOps: GitHub Actions pipeline integrating secret scanning (Gitleaks), container/SCA vulnerability scanning (Trivy), and custom AST-based static analysis rules (Semgrep).
• Formal Threat Modeling: STRIDE-based threat modeling and root-cause vulnerability analyses mapped to MITRE CWE and OWASP standards.

---

🗺️ System Architecture & Trust Zones

flowchart TB
    subgraph TZ0["Trust Zone 0: Untrusted / Public Network"]
        Client["🌐 External API Client / Attacker"]
    end

    subgraph TZ1["Trust Zone 1: Service Ingress & Authentication Gate"]
        AuthSvc["🔐 Auth Service (:8001)\n- Bcrypt Password Hashing\n- Strict HS256 JWT Minting\n- Rate Limiting Middleware\n- Token Verification API"]
        CoreApi["📦 Core Resource API (:8002)\n- Multi-Tenant CRUD Operations\n- Context Authorization Middleware\n- SSRF & DNS-Rebinding Firewall"]
    end

    subgraph TZ2["Trust Zone 2: Isolated Container Mesh (appsec-net)"]
        RedisCache[("⚡ Redis 7 Cache (:6379)\nNamespace: record:{tenant_id}:{record_id}")]
        PgDb[("🐘 PostgreSQL 16 DB (:5432)\n- users table (bcrypt hashes)\n- records table (tenant_id scoped)")]
    end

    subgraph TZ3["Trust Zone 3: Outbound Egress Boundary"]
        ExtWebhooks["🌍 External Public Webhook Targets"]
        CloudMeta["🛑 Cloud Metadata (169.254.169.254) [BLOCKED]"]
        InternalNet["🛑 RFC 1918 / Loopback Subnets [BLOCKED]"]
    end

    Client -->|HTTPS / REST| AuthSvc
    Client -->|HTTPS / Bearer JWT| CoreApi
    AuthSvc -->|Async Wire Protocol| PgDb
    CoreApi -->|Async Wire Protocol| PgDb
    CoreApi -->|RESP Protocol| RedisCache
    CoreApi -->|Safe HTTP/S Egress| ExtWebhooks
    CoreApi -.->|DNS Pre-flight & IP Pinning Blocks| CloudMeta
    CoreApi -.->|CIDR Validation Blocks| InternalNet

Loading

Services Breakdown

Service	Port	Primary Responsibilities	Data Store / Caching
Auth Service (services/auth)	8001	User registration, password hashing (bcrypt), login authentication, strict HS256 JWT minting and claim validation, sliding window rate limiting.	PostgreSQL (appsec_db.users)
Core Resource API (services/api)	8002	Multi-tenant resource CRUD, tenant-scoped caching, cache eviction, SSRF & DNS-rebinding safe outbound webhook testing, HTTP security headers.	PostgreSQL (appsec_db.records) + Redis (record:{tenant_id}:{id})
PostgreSQL Engine	5432	Relational storage with strict foreign keys, indexes, and connection pooling with pre-ping validation.	Persistent Volume (postgres_data)
Redis Cache	6379	In-memory key-value cache enforcing tenant isolation, distributed rate limiting, and TTL management.	Persistent Volume (redis_data)

---

🛡️ Shift-Left CI/CD Security Gates

Every push and pull request to main undergoes automated validation across 4 shift-left security stages defined in .github/workflows/security.yml:

+---------------------------------------------------------------------------------------------------+
|                                  GITHUB ACTIONS SECURITY PIPELINE                                 |
+---------------------------------+---------------------------------+-------------------------------+
| 1. Secret Scanning (Gitleaks)   | 2. SAST Analysis (Semgrep)      | 3. SCA & Container (Trivy)    |
| - Scans commit history & blobs  | - Custom AST rules (.semgrep/)  | - Scans repo filesystem       |
| - Blocks leaked keys/secrets    | - Checks BOLA & SSRF patterns   | - Scans Docker images for CVEs|
+---------------------------------+---------------------------------+-------------------------------+
                                                  |
                                                  v
+---------------------------------------------------------------------------------------------------+
| 4. Functional & Exploit Regression Testing (Pytest)                                               |
| - Executes 26 automated tests: unit suites, multi-tenant integration flows, and exploit suite     |
| - Verifies exploit payloads are rejected with HTTP 401 Unauthorized / 404 Not Found / 400 Bad Req |
+---------------------------------------------------------------------------------------------------+

---

🔍 Vulnerability Lifecycle & Remediation Matrix

Vulnerability & Category	Root Cause Mechanism	Exploit Vector	Defense-in-Depth Remediation	SAST Rule Enforcement
Broken Object-Level Authorization (BOLA / IDOR) OWASP API1:2023 CWE-639 / CWE-284	Unscoped database lookup (select(Record).where(Record.id == id))	Tenant B accesses or overwrites Tenant A's records by UUID enumeration	Compound SQL query filtering (WHERE id = :id AND tenant_id = :tenant_id) + Redis cache namespace isolation	.semgrep/idor-missing-tenant-filter.yml
Broken Authentication (JWT 'none' Flaw) OWASP API2:2023 CWE-327 / CWE-347	Unrestricted JWT decode allowing unsigned or alg: "none" tokens	Attacker creates unsigned token claiming root admin rights on victim tenant	Enforce strict algorithm whitelist (algorithms=["HS256"]), minimum 32-char entropy validation, and mandatory signature verification	PyJWT security configuration
Server-Side Request Forgery (SSRF) & DNS Rebinding OWASP API7:2023 CWE-918	Unfiltered outbound HTTP client requests in webhook tester	Exfiltrates AWS/GCP metadata (169.254.169.254) or probes internal microservices via DNS rebinding	Pre-flight DNS resolution, IP pinning with Host preservation, and CIDR validation blocking loopback, link-local, and RFC 1918 ranges	.semgrep/ssrf-unvalidated-http-client.yml

For complete technical analysis, see Root-Cause Vulnerability Analysis.

---

🚀 Quickstart & Execution

1. Prerequisites

• Docker & Docker Compose
• Python 3.11+
• Make (optional, for CLI shortcuts)

2. Boot the Microservices Stack

# Build and start all services (Auth, API, Postgres, Redis) in the background
docker compose up --build -d

# Verify health status
curl http://localhost:8001/health
curl http://localhost:8002/health

3. Run Automated Security & Regression Tests

# Run all 26 unit, integration, and exploit regression tests
make test
# Or using pytest directly:
pytest -v tests/

4. Execute Static Application Security Testing (SAST)

# Run custom Semgrep AST security rules
make scan
# Or using semgrep directly:
semgrep scan --config=.semgrep/ --error

5. Convenient Makefile Commands

Command	Action
make test	Execute full automated test suite (Unit, Integration, Security Exploit Regression)
make test-unit	Run unit tests only (tests/unit/)
make test-integration	Run integration tests only (tests/integration/)
make test-security	Run exploit regression tests only (tests/security/)
make scan	Run custom Semgrep SAST rules (.semgrep/)
make build	Build container images
make up	Start stack via Docker Compose
make down	Tear down containers and networks
make logs	Tail real-time service logs
make clean	Remove temporary cache files and test databases

---

📚 Security Documentation & Threat Modeling

• Threat Model & STRIDE Matrix (docs/threat-model.md): Comprehensive STRIDE analysis across all components, asset classification, trust boundary maps, and residual risk tracking.
• Root-Cause Vulnerability Analysis (docs/vulnerability-analysis.md): In-depth breakdown of BOLA/IDOR, JWT algorithm confusion, and SSRF flaws, exploit vectors, remediations, and Semgrep AST detection patterns.

---

🚀 Key Security Engineering Highlights

• Multi-Tenant Authorization & BOLA Elimination: Enforces compound database filtering (WHERE id = :id AND tenant_id = :tenant_id) alongside tenant-scoped Redis cache namespaces (record:{tenant_id}:{id}), preventing cross-tenant data access (OWASP API1:2023 / CWE-639).

• Shift-Left DevSecOps & AST Static Analysis: Integrated GitHub Actions pipeline enforcing Gitleaks secret detection, Trivy vulnerability scanning, and custom Semgrep AST rules to catch unscoped queries and unmediated HTTP client calls prior to deployment.

• SSRF & DNS-Rebinding Network Defense: Pre-flight DNS resolution with socket IP pinning and CIDR verification to block Server-Side Request Forgery against cloud metadata (169.254.169.254), loopback, and RFC 1918 internal subnets.

• Automated Exploit Regression Harness: Deterministic pytest regression harness verifying exploit payloads are rejected (HTTP 401 Unauthorized, 404 Not Found, 400 Bad Request) across all critical trust boundaries.

---

📄 License

This benchmark project is licensed under the MIT License.