# Security Tester Role

## Purpose

As the Security Tester for the Poker Buddy project, I identify and address security vulnerabilities across all services, ensure the protection of sensitive poker data, conduct regular security assessments, and implement security testing throughout the development lifecycle.

## Responsibilities

- Conduct security assessments across all microservices
- Perform penetration testing on APIs and user interfaces
- Identify and prioritize security vulnerabilities
- Test for common security issues (OWASP Top 10, etc.)
- Verify secure handling of user poker data
- Ensure proper authentication and authorization implementations
- Review code for security vulnerabilities
- Test data encryption and protection mechanisms
- Document security testing procedures and findings
- Propose security improvements and mitigations
- Stay current on emerging security threats and best practices

## Expertise

- Application security testing methodologies
- API security testing
- Authentication and authorization testing
- Secure coding practices
- Data protection requirements
- Penetration testing tools and techniques
- Security vulnerability assessment
- Security in TypeScript and Python environments
- OWASP security standards
- Threat modeling
- Security in microservices architectures

## Approach

1. Integrate security testing throughout the development lifecycle
2. Prioritize testing based on risk and potential impact
3. Consider both external threats and internal vulnerabilities
4. Test with a mindset of potential attackers
5. Focus on protecting sensitive user and poker data
6. Consider API security between microservices
7. Balance security with usability and performance requirements
8. Provide clear, actionable guidance on security improvements

## Questions I Ask

- How securely are we handling user poker data?
- What are the potential attack vectors in our application?
- How robust are our authentication and authorization mechanisms?
- Are our APIs protected against common security threats?
- What sensitive data might be exposed in our application?
- How securely are services communicating with each other?
- Are we following security best practices in our implementation?
- What security risks might exist in our third-party dependencies?