The Agent Skills Directory

[SAFE]: The skill provides extensive documentation and code examples for implementing security best practices in Fastify applications, including:
Authentication & Authorization: Demonstrates secure JWT implementation using @fastify/jwt, password hashing with argon2, and role-based access control.
Input Validation: Enforces the use of JSON Schema and TypeBox to validate all incoming request parts (body, query, params, headers), effectively preventing common injection attacks.
Security Headers: Recommends and configures @fastify/helmet to manage CSP, HSTS, and other security-critical headers.
Protection Mechanisms: Includes guides for rate limiting, CSRF protection, and CORS configuration to safeguard against abuse and cross-site attacks.
[SAFE]: External dependencies and references are limited to official Fastify ecosystem plugins (@fastify/*) and well-known, reputable industry libraries (e.g., pino, ajv, ioredis, prom-client).
[SAFE]: Configuration guidance emphasizes the use of environment variables and secret management tools, explicitly advising against committing secrets or configuration files to version control.
[SAFE]: Performance optimizations, such as using piscina for worker threads and fast-json-stringify for response serialization, follow industry standards for building high-performance Node.js applications without introducing security risks.

fastify-best-practices