Security Engineer Assessment Template

A web app stores passwords using MD5. Which is the MOST accurate critique?

• A.MD5 is fast and appropriate for passwords
• B.MD5 is broken cryptographically and vulnerable to collision
• C.MD5 is acceptable with a salt
• D.MD5 is fine; the issue is storage location

Hint: Password hashing needs specific properties.

Review this Python code and identify all security issues: ```python @app.route('/search') def search(): q = request.args.get('q') db.execute(f"SELECT * FROM items WHERE name LIKE '%{q}%'") return jsonify(result) ``` List every issue and write a secure version.

Implement secure password hashing and verification: - Use Argon2id (or bcrypt if unavailable) - Configurable memory cost and parallelism - Compare-in-constant-time for verification - Rehash on verify if parameters have changed Return { hash, verify, rehashNeeded } functions.

Threat-model a SaaS app with multi-tenant Postgres, OAuth login, and webhooks. Identify top 5 risks using STRIDE and propose mitigations for each.