Security Engineering

Purpose

Security failures in AI-assisted development happen not because the AI produces insecure code on purpose, but because vibe-coders do not ask for security in their prompts. This skill changes that: it exists to run an explicit security pass over every user-facing feature.

SOP: Security Hardening

Step 1 - Threat Model (Minimal)

For each feature, answer:

1. What data does this endpoint read or write?
2. Who should be allowed to call this endpoint? (Any user, authenticated user only, admin only, internal service only?)
3. What is the impact if this endpoint is abused? (Data breach? Account takeover? Financial loss?)

High-impact answers mean higher scrutiny in subsequent steps.

Step 2 - OWASP Top 10 Checklist (FastAPI + Next.js)