Security Best Practices

Overview

This skill provides a description of how to identify the language and frameworks used by the current context, and then to load information from this skill's references directory about the security best practices for this language and or frameworks.

This information, if present, can be used to write new secure by default code, or to passively detect major issues within existing code, or (if requested by the user) provide a vulnerability report and suggest fixes.

Workflow

Identify every language and framework in scope — frontend and backend both, when present — and read each matching reference: <language>-<framework>-<stack>-security.md plus any <language>-general-<stack>-security.md. If a web app's frontend framework is unspecified, also read javascript-general-web-frontend-security.md.

If no reference matches, fall back to well-known security guidance for that language and framework, consulting official documentation online when needed.

From there it can operate in a few ways.

1. The primary mode is to just use the information to write secure by default code from this point forward. This is useful for starting a new project or when writing new code.

2. The secondary mode is to passively detect vulnerabilities while working in the project and writing code for the user. Critical or very important vulnerabilities or major issues going against security guidance can be flagged and the user can be told about them. This passive mode should focus on the largest impact vulnerabilities and secure defaults.