secure-coding Skill

Goal

This skill guides the implementation of security controls during development (Shift Left).

Steps

1. Input Validation (Defense)

"Never trust input."

• Syntactic Validation: Is it an email? Is it a number? (Use Zod/Pydantic).
• Semantic Validation: Is start_date before end_date? Is transfer_amount > 0?
• Allow-list: Only accept known good characters (e.g., [a-zA-Z0-9]). Block everything else.

2. Output Encoding (Defense)

"Context matters."

• HTML Context: Escape < -> <. (Prevent XSS).
• SQL Context: Use Parameterized Queries. (Prevent SQLi).
• JSON Context: Ensure valid JSON structure.