software-security-appsec
Installation
SKILL.md
Software Security And AppSec
Use this skill for application-layer security: authentication, authorization, input and output handling, cryptography, supply-chain controls, API security, threat modeling, and security reviews. It is the AppSec decision layer, not general backend or infrastructure hardening.
Quick Reference
| Task | Use |
|---|---|
| Auth and authorization choices | references/authentication-authorization.md, assets/web-application/template-authentication.md, assets/web-application/template-authorization.md |
| Input handling, uploads, rendering, and common bugs | references/input-validation.md, references/common-vulnerabilities.md |
| Secure design and threat modeling | references/secure-design-principles.md, references/threat-modeling-guide.md |
| API and supply-chain security | references/api-security-patterns.md, references/supply-chain-security.md, assets/api/template-secure-api.md |
| Crypto and transport choices | references/cryptography-standards.md |
| Secret-storage selection | See "Secret-Storage Selection" below — choosing encrypted vs plaintext at the provider, and how to verify after storing |
| Incident response and security program framing | references/incident-response-playbook.md, references/security-business-value.md, references/operational-playbook.md |
Secret-Storage Selection
Every major cloud provider has two surface-similar storage classes: one encrypted-at-rest with no readback, one plaintext-visible in the dashboard. Picking the wrong one is silent — the app still works — and the audit log for who-read-what exists only on the encrypted form. Plaintext reads are invisible.