security-best-practices
Installation
SKILL.md
Security Best Practices
Review and harden application code against the vulnerabilities that actually get exploited: injection, broken authentication, IDOR, XSS, insecure secrets, weak dependencies. This skill is actionable engineering guidance, not a compliance checklist — each vulnerability class maps to a concrete code-level fix, with cheat-sheets for Python, JavaScript/TypeScript, and Go plus a worked secure-login example.
Quick Reference
| Topic | Reference |
|---|---|
| STRIDE worksheet, trust boundaries, least privilege, DFDs | threat-modeling.md |
| JWT verification, OAuth2 flows, OIDC, token storage | jwt-oauth.md |
Core Workflow
- Scope the review. List entry points (HTTP routes, message consumers, CLIs, file processors), sensitive data (PII, credentials, payment data), and trust boundaries. Note the languages/frameworks so the right cheat-sheet applies.
- Threat-model in 5 minutes. Run the STRIDE table below per entry point; mark high-risk flows (auth, uploads, deserialization, outbound HTTP). Full worksheet: threat-modeling.md.
- Walk the OWASP map. Check every applicable row in the table below. Most findings come from three rows: access control (IDOR), injection, and security misconfiguration.
- Verify secure defaults and apply the cheat-sheet. TLS, headers, CORS, cookies, non-leaky errors (Secure Defaults), then grep for your language's dangerous patterns (SQL f-strings, pickle, innerHTML, eval) and fix confirmed hits.
- Report findings. Prioritize by severity × likelihood; give
file:line, the vulnerability class, why it matters, and the fix. Offer to implement the fixes.