Secure Coding Standards

When to use

This skill is the substrate layer for code work. It triggers when Claude is writing or reviewing code and there's no framework-specific skill that goes deeper.

Activates on:

• A question like "is this safe?", "review for security issues", "could someone abuse this?", "what could go wrong?".
• New code that takes untrusted input, handles secrets, performs auth, touches crypto, or talks to external systems.
• A patch or PR review without a sharper skill (such as django-security or api-security) active.
• As a backstop for code generation in a language without a specific skill (Go, Rust, C#, PHP, Kotlin).

When NOT to use (handoff to sharper skills)