security

name	security
description	Security guidelines and OWASP Top 10. Use when reviewing security, implementing authentication or authorization, hardening code, or discussing vulnerabilities.
triggers	{"files":["**/auth/**","**/identity/**","**/security/**","**/middleware/**","*.security.*","*Auth*.*","*Security*.*"],"keywords":["security","auth","authentication","authorization","OWASP","injection","XSS","CSRF","JWT","password","vulnerability","encryption","hashing","bcrypt","token","session","RBAC","permissions","CORS","HSTS","CSP","SQL injection","SSRF","rate limit"]}
auto_suggest	true

Security

This skill provides universal security guidelines and OWASP Top 10 best practices applicable to any technology stack.

See @REFERENCE.md for detailed documentation.

Quick Reference

• Validation: Always server-side, never trust client input
• Queries: Parameterized only (no SQL concatenation)
• Passwords: Hash with bcrypt/Argon2 (never MD5/SHA1)
• Secrets: Environment variables or vault (never in code)
• Headers: CSP, X-Frame-Options, HSTS, nosniff