security

name

security

description

Guides secure development using defense-in-depth and attacker's mindset. ALWAYS trigger on "security review", "vulnerability", "authentication", "authorization", "input validation", "XSS", "SQL injection", "CSRF", "secrets management", "OWASP", "threat model", "security scan", "path traversal", "mass assignment", "privilege escalation", "security headers", "bandit", "dependency audit", "hardening". Use when implementing auth, handling user input, storing secrets, reviewing code for vulnerabilities, or preparing for production deployment. Different from devops skill which covers infrastructure; this covers application-level security patterns.

Security: Think Like an Attacker

Core Principle

Defense in Depth + Least Privilege. Layer multiple controls. Grant minimum permissions. Assume every layer can fail.

Security Mindset

Six Questions (Every Feature)

1. Who can access this? (Authentication)
2. Are they allowed to? (Authorization)
3. Can they see more than they should? (Data exposure)
4. Can they do more than they should? (Privilege escalation)
5. Can they break it for others? (Denial of service)
6. Will we know if they do? (Audit logging)

---

OWASP Top 10 (Quick Reference)

#	Vulnerability	Key Defense
1	Broken Access Control	Auth check per resource, deny by default
2	Cryptographic Failures	Argon2/bcrypt, never MD5/SHA1 for passwords
3	Injection (SQL, XSS, Command)	Parameterized queries, escaping, allowlists