| name | security-compliance |
| description | Implement comprehensive security for shared library. Use when working with security audits, dependency vulnerabilities, API security, token encryption, or secure coding practices for library consumers. Library security impacts all consuming plugins. |
Security & Compliance Guardian
Mission
Ensure Lidarr.Plugin.Common provides secure foundation for all consuming plugins through comprehensive security practices and secure defaults.
Current Security Infrastructure
- ✅ CodeQL Scanning: Weekly automated scans
- ✅ Secret Scanning: GitLeaks active + historical
- ✅ Dependency Review: PR-based vulnerability checks
- ✅ OpenSSF Scorecard: Weekly security assessment
- ✅ Token Encryption: DPAPI/Keychain/SecretService support
- ✅ Azure Key Vault: Optional encrypted storage
Library-Specific Security
Secure Defaults
- All APIs secure by default
- No insecure opt-in options
- Fail-secure error handling
- Encrypted token storage
Consumer Impact
- Security issues affect ALL plugins
- Breaking fixes may require major versions
- Clear security migration guides
- Responsible disclosure process
Expertise Areas
1. Secure API Design
- Input validation patterns
- Output sanitization
- Error handling without information leakage
- Cryptographic best practices
2. Authentication Security
- OAuth 2.0 + PKCE implementation
- Token storage encryption
- Session management security
- Credential rotation support
3. Data Protection
- At-rest encryption (DPAPI, Keychain, Secret Service)
- In-transit security (TLS/HTTPS enforcement)
- Azure Key Vault integration
- Secure cache management
4. Supply Chain Security
- Package signing (NuGet)
- Dependency pinning and lock files
- SBOM for library releases
- Transitive dependency monitoring
5. Vulnerability Management
- CVE monitoring and response
- Security advisory creation (GitHub)
- Breaking security fixes process
- Backport security patches to old versions
Enhancement Opportunities
- Package Signing: Sign NuGet packages with certificate
- Security Documentation: Consumer security guide
- Threat Model: Library-specific threat analysis
- Fuzzing: Add fuzz testing for parsers and validators
- Penetration Testing: Regular third-party security audits
Security Checklist for Library
Related Skills
api-versioning - Security through API contractsrelease-automation - Secure releases with SBOM
Examples
Example 1: Handle Security Vulnerability in Dependency
User: "FluentValidation has a critical CVE"
Action: Assess impact, update version, test compatibility, create security advisory, release patch for supported versions
Example 2: Add Token Encryption
User: "Implement encrypted token storage"
Action: Use DPAPI (Windows), Keychain (macOS), Secret Service (Linux), add Azure Key Vault support, document usage
Example 3: Security Audit Findings
User: "Penetration test found API key in logs"
Action: Remove sensitive data from logs, add log scrubbing, update documentation, release hotfix, notify consumers
