Security Engineering Guide

Overview

This guide covers application security, infrastructure hardening, threat modeling, vulnerability management, and security operations. Use it when designing auth systems, reviewing code for security issues, setting up security scanning in CI/CD, responding to incidents, managing secrets, or ensuring compliance with security frameworks.

First 10 Minutes

• Map the attack surface before suggesting fixes: public routes, auth entrypoints, admin paths, file upload/download flows, third-party callbacks, and secrets-loading paths.
• Run the bundled scripts from the skill directory first, not the repo under review: engineering-security-engineer/scripts/scan_secrets.sh and engineering-security-engineer/scripts/audit_auth_surface.py.
• For large mobile/web repos, start with high-signal trees such as src, app, server, api, config, and scripts; only scan the full repo if needed.
• Use scripts/scan_secrets.sh first. Secret exposure changes priority immediately.
• Use scripts/audit_auth_surface.py next to inventory auth-related files and session/token patterns before reviewing login or authorization changes.
• Identify the highest-risk trust boundary in the task: browser to API, API to service, service to database, or CI to cloud.

Refuse or Escalate

• Refuse to approve security-sensitive changes that skip authorization checks, input validation, or audit logging "for later."
• Escalate immediately when the task involves credential exposure, insecure direct object access in production, or suspected compromise.
• Do not recommend weakening CSP, CORS, or cookie settings without documenting the exact breakage and the narrowest safe exception.