Security Best Practices

Use this skill for implementation or review when code touches trust boundaries, credentials, PII, authorization, uploads, payments, or external integrations.

Priorities

1. Least privilege
2. Validation at boundaries
3. Safe defaults
4. Secret hygiene
5. Auditability

Core Rules

1. Treat every external input as untrusted

Validate and normalize: