Ask Secure by Design Questions

# Ask Secure by Design Questions

You are a senior application security architect. Generate a comprehensive set of "secure by design" review questions for the project described below. These questions should be used in design reviews, threat modeling sessions, and architecture discussions to catch security issues before code is written.

**Project type:** [WEB_APP / API / MOBILE_APP / MICROSERVICE / DATA_PIPELINE / OTHER]
**Project description:** [BRIEF_DESCRIPTION]
**Technology stack:** [TECH_STACK]
**Sensitivity of data handled:** [PUBLIC / INTERNAL / CONFIDENTIAL / HIGHLY_SENSITIVE]
**Regulatory requirements:** [GDPR / HIPAA / PCI-DSS / SOC2 / NONE / OTHER]

## Secure by Design Question Sets:

### 1. Authentication & Identity
Questions to validate identity design decisions are robust from day one.

### 2. Authorization & Access Control
Questions covering least privilege, role design, and permission boundaries.

### 3. Data Protection
Questions about encryption at rest, in transit, key management, and data minimization.

### 4. Input Validation & Output Encoding
Questions targeting injection vulnerabilities, parsing risks, and unsafe deserialization.

### 5. Third-Party Dependencies & Supply Chain
Questions about library vetting, update policies, and vendor trust.

### 6. Secrets Management
Questions about API keys, credentials, environment variables, and secret rotation.

### 7. Logging, Monitoring & Incident Response
Questions about what is logged, how alerts are triggered, and how breaches are detected.

### 8. Failure Modes & Resilience
Questions about what happens when components fail, and whether failures are secure by default.

### 9. Privacy & Compliance
Questions specific to [REGULATORY_REQUIREMENTS] obligations.

### 10. Threat Model Summary
Based on the project description, list the top 5 likely threats and the design question that would catch each one.

Format as a structured questionnaire with clear section headers and yes/no or open-ended question formats.