secure-coding
Installation
SKILL.md
Secure coding
Every rule here comes down to one decision: trust nothing that crossed the boundary, and say what's allowed rather than what's forbidden. A blocklist is a list of the attacks you thought of. Read the catalog for the input you're handling:
| The input or output | Read |
|---|---|
| Request bodies, HTML output, JSON inside a script element (JSON-LD), links, redirects, outbound URLs, file names and paths, logs, email headers, SQL, amounts, pagination, errors | CATALOG.md |
Response security headers by value: HTTPS redirects and mixed content, HSTS, CSP, framing, nosniff, Referrer-Policy, cookie attributes, exposed .env and .git files |
HEADERS.md |
| JWT validation, refresh-token rotation, API keys, permission checks, password hashing and upgrading it, TOTP two-factor, Next.js Server Action auth | AUTH.md |
| Tenant isolation: scoped queries plus Postgres row-level security, pooled connections, Supabase policies | TENANCY.md |
| Encrypting stored secrets (AES-GCM, key versions, KMS), keeping internal services off the internet | SECRETS-AND-NETWORK.md |
| Parsers that disagree (IP spellings, duplicate JSON keys, request smuggling, Unicode lookalikes), ReDoS and expansion bombs, CSV formulas, shell arguments, card numbers in logs, CORS, reset tokens, delegation chains, webhook signatures | PARSERS.md |
| Browser and Electron boundaries: window messages, cross-tab identity, service-worker caches, DOM gadgets, cross-site observations and IPC sender/bridge controls | BROWSER-BOUNDARIES.md |
| Package installation boundaries: version-specific lifecycle-script policies, direct and transitive execution, dependency sources, evidence and exceptions | PACKAGE-INSTALLS.md |
Apply only the routes and checks for the selected job. Read a linked skill's named file from its installed folder when available, or from the linked source. Report an unavailable required reference instead of inventing it. [skill-authoring, DISTRIBUTION.md#composing-skills]