security-best-practices

name	security-best-practices
description	Routing-first skill for web/application/API hardening. Use when the main job is classifying which security layer is missing — browser/perimeter policy, session/cookie/CSRF, abuse controls, validation/unsafe execution, secrets/runtime config, or verification — and turning vague OWASP/security asks into one concrete hardening brief. Route auth-stack choice to `authentication-setup`, schema work to `database-schema-design`, code-level bug fixing to `debugging` / `code-review`, and environment wiring to `system-environment-setup`.
allowed-tools	Bash Read Write Edit Glob Grep
compatibility	Best for web apps, APIs, backend/fullstack services, marketing-site forms, edge/frontend-plus-backend systems, and game-adjacent service/web launch surfaces where the team needs a vendor-neutral hardening workflow instead of a giant middleware or scanner checklist.
license	MIT
metadata	{"version":"2.1.0","modernization":"2026-04-14T00:00:00.000Z","hardening":"2026-04-18T00:00:00.000Z","tags":"security-best-practices, owasp, appsec, csp, csrf, secrets, rate-limiting, web-security, api-security","platforms":"Claude, ChatGPT, Gemini, Codex"}

Security Best Practices

Use this skill when the job is to name one missing security layer and turn it into a bounded hardening brief.

The job is not to dump a giant OWASP list, middleware catalog, or scanner parade. The job is to:

1. frame the surface and risk,
2. choose one primary hardening mode,
3. recommend the smallest credible first slice,
4. name the verification ladder,
5. route adjacent work honestly.

Read these support docs first:

• references/modes-and-boundaries.md
• references/mode-packets-and-route-outs.md
• references/hardening-review-checklist.md
• references/verification-ladder.md

When to use this skill

• A team says “make this secure” and the missing security layer is still unclear
• A web app, API, marketing-site flow, admin panel, or game-service surface needs a hardening pass before launch or migration
• You need to decide whether the main problem is CSP/headers, cookies/CSRF, abuse controls, validation/unsafe execution, secret handling, or weak verification
• Scanner findings, OWASP requests, or launch-review notes need to be converted into one prioritized hardening brief
• The current stack has some controls already, but trust is low and the next verification step is unclear

When not to use this skill

• The main job is choosing an auth vendor, session architecture, org/member model, or enterprise SSO path → authentication-setup
• The main job is API contract/interface design before security controls are slotted in → api-design
• The main job is schema constraints, token tables, indexes, or migration safety → database-schema-design
• The main job is backend regression coverage or auth/security test implementation → backend-testing
• The main job is fixing a specific vulnerability in code or reviewing a concrete diff → debugging or code-review
• The main job is secret injection mechanics, toolchain bootstrapping, or environment wiring → system-environment-setup / environment-setup
• → use the infrastructure-specific skill instead of this app-hardening anchor