Skip to main content Home Creators tomevault-io skills-registry devssecurity-core
devssecurity-core Comprehensive application security expertise covering authentication, authorization, OWASP Top 10, and security best practices. Use when (1) Implementing authentication (JWT, OAuth2, sessions, OAuth for CLI/TUI/desktop apps), (2) Adding authorization (RBAC, ABAC, RLS with Supabase/PostgreSQL), (3) Security auditing code or infrastructure, (4) Setting up security infrastructure (headers, CORS, CSP, rate limiting), (5) Managing secrets and credentials, (6) Preventing OWASP Top 10 vulnerabilities (injection, XSS, CSRF, etc.), (7) Reviewing code for security issues, (8) Configuring secure web applications in TypeScript, Python, or Rust. Automatically triggered when working with authentication/authorization systems, security reviews, or addressing security vulnerabilities. Use when this capability is needed.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/tomevault-io/skills-registry --skill devssecurity-coreThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository
Related occupations SOC
Based on SOC occupation classification
name devssecurity-core description Comprehensive application security expertise covering authentication, authorization, OWASP Top 10, and security best practices. Use when (1) Implementing authentication (JWT, OAuth2, sessions, OAuth for CLI/TUI/desktop apps), (2) Adding authorization (RBAC, ABAC, RLS with Supabase/PostgreSQL), (3) Security auditing code or infrastructure, (4) Setting up security infrastructure (headers, CORS, CSP, rate limiting), (5) Managing secrets and credentials, (6) Preventing OWASP Top 10 vulnerabilities (injection, XSS, CSRF, etc.), (7) Reviewing code for security issues, (8) Configuring secure web applications in TypeScript, Python, or Rust. Automatically triggered when working with authentication/authorization systems, security reviews, or addressing security vulnerabilities. Use when this capability is needed. metadata {"author":"aaronbassett"}
Security Core
Comprehensive application security guidance for TypeScript, Python, and Rust applications.
Quick Start
Common Security Tasks
Setting up authentication:
Generate JWT keys: ./scripts/generate_jwt_keys.sh RS256
Consult authentication.md for implementation patterns
Use security templates from assets/configs/
Implementing authorization:
Review authorization.md for RBAC/ABAC/RLS patterns
For Supabase: See RLS section with multi-tenant examples
Implement permission checking at API and database layers
When to Use This Skill
Authentication Scenarios
Implementing login/signup flows
Adding JWT or session-based authentication
Integrating OAuth 2.0 providers
OAuth for CLI, TUI, or desktop applications (Device Flow)Multi-factor authentication (TOTP, SMS/Email OTP)
Password hashing and validation
Authorization Scenarios
Role-Based Access Control (RBAC)
Attribute-Based Access Control (ABAC)
Row Level Security (RLS) with Supabase/PostgreSQL Multi-tenant data isolation
Permission-based access control
Resource ownership validation
Security Auditing
Code security reviews
Dependency vulnerability scanning
OWASP Top 10 compliance checks
Secret detection in code
Security configuration verification
Infrastructure Security
Security headers (CSP, HSTS, X-Frame-Options)
CORS configuration
Rate limiting implementation
Secrets management
API security hardening
Core Resources
Scripts (scripts/) audit_security.sh
Runs dependency vulnerability scanners (npm audit, pip-audit, cargo-audit)
Detects hardcoded secrets in code
Checks for common security misconfigurations
Usage: ./scripts/audit_security.sh [project-directory]
generate_jwt_keys.sh
Supports HS256 (symmetric), RS256 (asymmetric), ES256 (elliptic curve)
Automatically adds keys to .gitignore
Provides usage examples
Usage: ./scripts/generate_jwt_keys.sh [ALGORITHM] [OUTPUT_DIR]
Reference Documentation (references/)
JWT implementation (TypeScript, Python, Rust)
Session-based authentication
OAuth 2.0 Authorization Code Flow
OAuth Device Flow for CLI/TUI/desktop apps ⭐Multi-factor authentication (TOTP, SMS)
Password security and hashing
Token storage best practices
Role-Based Access Control (RBAC)
Attribute-Based Access Control (ABAC)
Row Level Security (RLS) with Supabase/PostgreSQL ⭐Multi-tenant RLS patterns
Permission checking patterns
Resource-based authorization
Testing authorization logic
A01: Broken Access Control
A02: Cryptographic Failures
A03: Injection (SQL, NoSQL, Command)
A04: Insecure Design
A05: Security Misconfiguration
A06: Vulnerable Components
A07: Authentication Failures
A08: Data Integrity Failures
A09: Logging & Monitoring Failures
A10: Server-Side Request Forgery (SSRF)
Environment variables best practices
Secret managers (AWS Secrets Manager, HashiCorp Vault)
Secret rotation strategies
CI/CD secrets handling
Local development with .env files
Content-Security-Policy (CSP)
Strict-Transport-Security (HSTS)
X-Frame-Options, X-Content-Type-Options
CORS configuration
Implementation examples for all frameworks
Fixed window, sliding window, token bucket
Implementation in TypeScript, Python, Rust
Distributed rate limiting with Redis
Per-user and per-IP limiting
Rate limit headers and responses
Authentication & authorization checks
Input validation & sanitization
Data protection and encryption
Security headers & configuration
Session management
API security
Common vulnerabilities (XSS, CSRF, SQL injection)
Configuration Templates (assets/configs/) Ready-to-use security middleware for all supported languages:
TypeScript: assets/configs/typescript/security-config.ts
Express + Helmet configuration
CORS setup
Rate limiting
Security headers
Python: assets/configs/python/security_middleware.py
FastAPI middleware
Security headers
CORS
Rate limiting with slowapi
Rust: assets/configs/rust/security_middleware.rs
Axum middleware
tower-http CORS layer
Security headers
Decision Guides
Choosing Authentication Method Method Use When Complexity Best For JWT Stateless APIs, microservices Medium SPAs, mobile apps, APIs Sessions Traditional web apps Low Server-rendered apps OAuth 2.0 Third-party auth, SSO High Delegated authentication API Keys Service-to-service Low Internal services
Choosing Authorization Model Model Use When Complexity Best For RBAC Simple role hierarchies Low Standard web apps ABAC Complex, dynamic policies High Enterprise apps RLS Multi-tenant with data isolation Medium SaaS applications Permissions Fine-grained control Medium Admin panels, APIs
OAuth for CLI/TUI/Desktop For applications without traditional browser redirects:
Device Authorization Flow (OAuth 2.0):
App requests device code
User opens browser and enters code
App polls for token
Token granted after user approval
Common Workflows
1. Implementing JWT Authentication
./scripts/generate_jwt_keys.sh RS256 ./keys
Then implement using examples for your language (TypeScript/Python/Rust).
2. Adding Row Level Security (Supabase) Implement RLS policies for multi-tenant isolation:
Enable RLS on tables
Create policies for SELECT, INSERT, UPDATE, DELETE
Use helper functions for complex rules
Test with different user contexts
3. Security Audit Workflow
./scripts/audit_security.sh
4. Hardening New Application
Apply security templates:
Copy appropriate config from assets/configs/[language]/
Configure CORS for your domains
Set up rate limiting
Implement authentication:
Add authorization:
Choose model from authorization.md
Implement permission checks
Enable RLS if multi-tenant
Configure security headers:
Set up secrets management:
Review OWASP Top 10:
Language-Specific Guidance
TypeScript/Node.js
Use Helmet for security headers
Validate inputs with Zod
Use prepared statements for SQL
Hash passwords with bcrypt
See config: assets/configs/typescript/security-config.ts
Python/FastAPI
Use Pydantic for validation
Parameterized queries only
Hash passwords with bcrypt
Security middleware in startup
See config: assets/configs/python/security_middleware.py
Rust
Compiler prevents many issues
Validate at boundaries
Use sqlx for type-safe SQL
Hash passwords with argon2
See config: assets/configs/rust/security_middleware.rs
Best Practices
Defense in Depth - Multiple security layersLeast Privilege - Grant minimum necessary permissionsFail Securely - Default to denyKeep Secrets Secret - Never commit credentialsValidate Everything - All inputs at boundariesUse Strong Crypto - Modern algorithms onlyLog Security Events - Authentication, authorization failuresUpdate Dependencies - Regular security patchesRate Limit - Protect against abuseTest Security - Automated security tests
Testing Security Write tests for security concerns:
it ('should reject invalid credentials' );
it ('should rate limit login attempts' );
it ('should require MFA when enabled' );
it ('should deny unauthorized access' );
it ('should allow access for correct role' );
it ('should enforce resource ownership' );
it ('should prevent SQL injection' );
it ('should sanitize HTML input' );
it ('should validate file uploads' );
Security Resources Primary references in this skill:
Getting Started For a new secure application:
For specific security concern:
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
