Security

Security is not a feature — it is a property of every feature. Every endpoint, every form, every data flow, every integration point must be designed with security in mind from the start. Bolting security on after the fact is expensive, error-prone, and often incomplete.

This skill provides stack-agnostic guidance for building secure applications. It covers the OWASP Top 10, input validation, authentication and authorization patterns, data protection, secrets management, security headers, and common antipatterns.

When to Use

Consult this skill when:

• Designing a new feature that handles user input, authentication, or sensitive data
• Reviewing code for security concerns
• Implementing authentication or authorization flows
• Handling secrets, API keys, or credentials
• Configuring HTTP security headers
• Assessing whether a dependency or design choice introduces risk
• Preparing for a security audit or penetration test
• Responding to a security incident or vulnerability report