Security

This skill provides guidance on writing secure code and identifying security vulnerabilities during code review.

Core Principles

• Defense in Depth: Layer multiple security controls; don't rely on a single defense
• Least Privilege: Grant minimum permissions necessary for functionality
• Don't Trust Input: Validate and sanitize all external input
• Keep It Simple: Complex code is harder to secure
• Fail Secure: When errors occur, fail closed rather than open

OWASP Top 10 (2025)

The OWASP Top 10 represents the most critical web application security risks.

A01: Broken Access Control

Failures in enforcing what authenticated users are allowed to do.