القائمة
Checklist for identifying and fixing common web security vulnerabilities (OWASP Top 10). Use when reviewing code for security issues.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Checklist for auditing and fixing accessibility issues (WCAG 2.1 AA compliance). Use when reviewing components or pages for accessibility.
Guide for creating RESTful API endpoints with validation and error handling. Use when implementing backend API routes.
Guide for implementing secure authentication with JWT and session management. Use when adding authentication to an application.
Guide for creating responsive layouts with CSS. Use when implementing responsive design or fixing layout issues.
Guide for designing database schemas with Prisma ORM. Use when creating or modifying database models.
Guide for consistent error handling across frontend and backend. Use when implementing error handling logic.
| name | security-audit |
| description | Checklist for identifying and fixing common web security vulnerabilities (OWASP Top 10). Use when reviewing code for security issues. |
Follow this checklist to identify and fix common security vulnerabilities:
✅ Check:
dangerouslySetInnerHTML without sanitization// ❌ Dangerous
<div dangerouslySetInnerHTML={{ __html: userInput }} />
// ✅ Safe - React escapes by default
<div>{userInput}</div>
// ✅ If HTML needed, sanitize first
import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{
__html: DOMPurify.sanitize(userInput)
}} />
✅ Check:
// Backend: CSRF token validation
import csrf from 'csurf';
const csrfProtection = csrf({ cookie: true });
app.post('/api/transfer', csrfProtection, (req, res) => {
// Process request
});
// Frontend: Include CSRF token
<form>
<input type="hidden" name="_csrf" value={csrfToken} />
{/* ... */}
</form>
✅ Check:
// ❌ Vulnerable
const query = `SELECT * FROM users WHERE email = '${userEmail}'`;
// ✅ Safe - Prisma parameterized query
const user = await prisma.user.findUnique({
where: { email: userEmail }
});
// ✅ Safe - Raw query with parameters
const users = await prisma.$queryRaw`
SELECT * FROM users WHERE email = ${userEmail}
`;
✅ Check:
// Cookie configuration
res.cookie('token', refreshToken, {
httpOnly: true, // Prevent XSS
secure: true, // HTTPS only
sameSite: 'strict', // CSRF protection
maxAge: 7 * 24 * 60 * 60 * 1000,
});
✅ Check:
// ❌ Bad - Secret exposed
const apiKey = "sk_live_abc123";
// ✅ Good - Use environment variables
const apiKey = process.env.API_KEY;
// ❌ Bad - Sensitive data in logs
console.log("User login:", { email, password });
// ✅ Good - No sensitive data
console.log("User login:", { email });
✅ Check:
// Express.js
import helmet from 'helmet';
app.use(helmet());
// Or manually
app.use((req, res, next) => {
res.setHeader('X-Content-Type-Options', 'nosniff');
res.setHeader('X-Frame-Options', 'DENY');
res.setHeader('X-XSS-Protection', '1; mode=block');
res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
res.setHeader('Content-Security-Policy', "default-src 'self'");
next();
});
✅ Check:
import { z } from 'zod';
const userSchema = z.object({
email: z.string().email().max(255),
age: z.number().int().min(0).max(150),
role: z.enum(['user', 'admin']), // Allowlist
});
// Validate
try {
const validData = userSchema.parse(req.body);
} catch (error) {
return res.status(400).json({ error: 'Invalid input' });
}
✅ Check:
import rateLimit from 'express-rate-limit';
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // 100 requests per window
message: 'Too many requests, please try again later',
});
const authLimiter = rateLimit({
windowMs: 15 * 60 * 1000,
max: 5, // Only 5 login attempts
});
app.use('/api/', limiter);
app.use('/api/auth/login', authLimiter);
✅ Check:
npm audit or pnpm audit# Check for vulnerabilities
pnpm audit
# Fix automatically
pnpm audit --fix
# Update dependencies
pnpm update --latest
✅ Check:
// Middleware: Check if user owns resource
async function requireOwnership(req, res, next) {
const post = await prisma.post.findUnique({
where: { id: req.params.id }
});
if (!post || post.userId !== req.userId) {
return res.status(403).json({ error: 'Forbidden' });
}
next();
}
app.delete('/api/posts/:id', authenticate, requireOwnership, async (req, res) => {
// Delete post
});
✅ Check:
// ❌ Bad - Exposes internal details
res.status(500).json({
error: error.stack,
query: sqlQuery
});
// ✅ Good - Generic message
res.status(500).json({
error: 'Internal server error'
});
// Log detailed error server-side
logger.error('Database error', {
error: error.message,
userId: req.userId
});
✅ Check:
const upload = multer({
limits: { fileSize: 5 * 1024 * 1024 }, // 5MB
fileFilter: (req, file, cb) => {
const allowedTypes = ['image/jpeg', 'image/png'];
if (!allowedTypes.includes(file.mimetype)) {
return cb(new Error('Invalid file type'));
}
cb(null, true);
},
});