Netsuite Owasp Secure Coding

OWASP Secure Coding Practices

1. Description

This skill provides implementation-depth OWASP secure coding coverage for JavaScript and SuiteScript 2.1 development. It is the primary security reference for writing, reviewing, and auditing code.

What This Skill Covers:

• Complete OWASP Top 10 (2021) mapping with code-level mitigation patterns
• 48 cataloged security pitfalls (OSCP-001 through OSCP-048) with BAD/GOOD code examples
• Platform-agnostic JavaScript security patterns applicable beyond NetSuite
• SuiteScript-specific security patterns for RESTlets, Suitelets, Client Scripts, and more
• Output encoding for five HTML contexts (body, attribute, JavaScript, URL, CSS)
• CSP header construction and deployment
• File upload/download validation pipelines
• API and RESTlet hardening patterns
• AI agent security considerations for tool-assisted development
• DRY security architecture: shared validation modules, centralized encoding, single-source configs
• A mandatory security review checklist for every code review

Relationship to Existing Security Content:

If available, the netsuite-sdf-leading-practices skill contains two security-related principles from the SAFE Guide:

• Principle 5 (`05-security-privacy.md`) -- Owns NetSuite-specific security topics: roles and permissions, token-based authentication (TBA), N/crypto module usage, PCI-DSS awareness, credential storage via script parameters, and SuiteCloud platform security features.
• Principle 11 (`11-security-best-practices.md`) -- Owns OWASP awareness-level guidance: the core security principles list, a high-level OWASP Top 10 overview, basic input sanitization patterns, and parameterized query awareness.

This skill (netsuite-owasp-secure-coding) provides everything below the awareness level: full implementation depth, exhaustive code patterns, all 48 pitfalls, context-specific encoding, CSP templates, file security, API hardening, client-side defenses, logging safety, and AI agent threat mitigation. It references Principles 5 and 11 where appropriate rather than duplicating their NetSuite-specific content.

2. How to Use

Invocation

Use this skill whenever you need a security review, threat analysis, or implementation guidance for SuiteScript or JavaScript security concerns.

If your client supports explicit skill activation by name, activate netsuite-owasp-secure-coding and request the topic you need.

Auto-Activation Triggers

This skill auto-activates when the agent detects security-relevant context in the conversation. See Section 3 for the complete trigger list.

Reference Files

All deep-dive content is in the local references/ directory. The skill loads the appropriate reference files based on the detected security topic. You can also request a specific reference directly:

Review this RESTlet for security issues.
Load the injection prevention reference.
Load the CSP header templates appendix.

3. When to Use

Keyword Triggers

The skill activates when any of the following keywords or phrases appear in the conversation or code context:

Injection and Input: injection, sanitize, sanitise, validate input, SQL concatenation, string concatenation query, parameterized, prepared statement, user input

XSS and Output: XSS, cross-site scripting, encode, output encoding, innerHTML, textContent, dangerouslySetInnerHTML, template literal injection

Authentication and Session: auth, authentication, session, CSRF, token, TBA, OAuth, credential, password, login, logout, session fixation

Headers and Browser: CSP, Content-Security-Policy, CORS, X-Frame-Options, HSTS, security header, postMessage, clickjacking

Cryptography: crypto, hash, encrypt, decrypt, MD5, SHA-1, SHA-256, Math.random, nonce, HMAC, AES, secret key

File Operations: file upload, file download, path traversal, MIME type, magic bytes, zip bomb, filename sanitization

API and Network: RESTlet, Suitelet, API security, rate limit, SSRF, webhook, schema validation, request validation

General Security: security, vulnerability, OWASP, pentest, hardening, exploit, attack surface, threat model, security review, security audit

AI and Agent: prompt injection, AI security, agent security, tool poisoning, AI output validation, data exfiltration

Code Context Triggers

The skill also activates when the agent detects these code patterns:

• Writing or reviewing RESTlet scripts (@NScriptType Restlet)
• Writing or reviewing Suitelets that generate HTML (response.write, INLINEHTML)
• Client scripts with DOM manipulation (innerHTML, document.write, eval)
• SuiteQL queries being constructed (query.runSuiteQL, query.runSuiteQLPaged, N/query)
• File operations (N/file, file.create, file.load)
• External HTTP calls (N/https, https.post, https.get)
• Cryptographic operations (N/crypto, createHash, createCipher)
• Any code review or security audit request

4. Companion Reference Map

This skill is self-contained. To avoid content duplication, this map distinguishes what this skill owns from optional companion references that may exist in a broader NetSuite guidance set.

Cross-Reference Rules:

1. Use this skill as the authoritative source for code-level implementation guidance.
2. If optional companion references are available, use them only for adjacent background such as role setup, token rotation, or high-level principles.
3. Do not assume companion references are installed; answer from this skill's local content first.

5. OWASP Top 10 (2021) Quick Map

Each OWASP Top 10 category is mapped to the reference files in this skill that provide detailed coverage.