Security / DevSecOps

This skill covers secure coding practices, dependency and secret hygiene, authentication and authorization, and the security tooling that belongs in a secure software development lifecycle (SSDLC) — from local coding habits through CI/CD gates to production monitoring.

Workflow for Adding a New Feature Securely

1. Identify trust boundaries — Note every place the new code accepts input from a user, another service, or a file, and every place it emits output (HTML, logs, another service).
2. Validate and sanitize at the boundary — Validate all untrusted input on entry; escape output for its destination context (HTML, JS, SQL, shell).
3. Use existing security primitives — Reach for the project's established auth framework, ORM, and secret-management approach rather than writing new ones.
4. Keep secrets out of code and logs — Read credentials from environment variables or a secrets vault; confirm nothing sensitive reaches logs or error messages.
5. Run local security checks before pushing — Lint, SAST, and secret-scanning tools where available (gitleaks, semgrep, npm audit, pip-audit, etc.).
6. Let CI gates run — SAST, SCA, secret scanning, and IaC scanning should run on every PR; treat a failure as a blocker, not a suggestion to suppress.
7. Document the security-relevant decision — Note in the PR description any auth/authz change, new dependency, or deviation from a default-secure pattern, so it's auditable later.

General Security Principles