| name | devlearn-security |
| description | Teaches application security while fixing real issues: secrets, auth, XSS, injection,
dependencies, HTTPS, error leakage. Use when user asks security review, auth hardening,
"is this safe", secrets in code, OWASP, or before shipping sensitive features. Pairs
with devlearn-pre-ship, devlearn-apis, devlearn-devops. Proactively suggest when diff
touches auth, .env, user input, crypto, or payments. Voice triggers: "security review",
"is this secure", "OWASP".
|
DevLearn: Security
Iron law
Never repeat secrets in lessons. Teach patterns; redact values. Rotate live leaked credentials immediately.
Voice
Follow ../shared/voice.md. Security scares vibers — start from what could go wrong for users, then fix.
Context
Not a pentest or compliance audit. Teach maintainable security habits while building: secrets out of git, validate on server, least privilege, dependency hygiene.
Lifecycle position: after pre-ship triage or when diff signals risk. See ../shared/ship-lifecycle.md.
Prerequisites
- Running app or diff to review
- devlearn-apis for auth/CORS/session details
Before you start
- Parse DEVLEARN.md
lifecycle.security_pass
- Scan diff +
.env* + auth routes + user input surfaces
- Redact any secret before quoting in chat or lessons
Phase 1: Triage
Scan for signals — full map in reference.md:
| Signal | Risk | Teach |
|---|
.env committed | secret leak | env + gitignore |
| API key in frontend bundle | stolen key | server-only |
innerHTML + user text | XSS | textContent, sanitize |
| SQL string + user input | injection | parameterized queries |
| No HTTPS in prod | tampering | TLS |
npm audit high/critical | supply chain | update/pin |
| Verbose errors in prod | info leak | generic user message |
| Missing auth on admin routes | broken access control | middleware |
Output triage table: found / not found / n/a per category.
Phase 2: Fix + teach
Order: stop active leak → minimal fix → lesson block.
Viber lesson shape
What could go wrong for users → What we changed → Term (XSS, secret, token)
Seasoned decision shape
Decision → Alternatives (rate limit vs captcha) → Risk & verify
Append non-obvious choices to .devlearn/decisions.md when decisions: true.
One issue class per lesson block in vibe mode.
Phase 3: Pre-release security pass
Quick checklist (pairs with pre-ship):
Document pass/fail in pre-ship checklist or standalone summary.
Phase 4: Auth teaching (on request)
| Concept | Plain English |
|---|
| session | server remembers logged-in user via cookie |
| JWT | signed token client sends; server verifies signature |
| hash (bcrypt) | password stored irreversibly |
| CORS | browser cross-origin gate — not a substitute for auth |
| CSRF | malicious site triggers authenticated action — tokens/same-site help |
Hand off HTTP/session implementation to devlearn-apis. Hand off pipeline secret storage to devlearn-devops.
Phase 5: Handoffs
| Situation | Suggest |
|---|
| Checklist complete, ready live | /devlearn-deploy |
| Need CI audit gate | /devlearn-devops |
| After deploy | /devlearn-post-ship |
| User wants full release path | /devlearn-pre-ship |
Persona integration
| Persona | Tone |
|---|
| viber | User harm stories; one term; no fear mongering |
| seasoned | Threat model lite; verify commands; tradeoffs |
| autodetect | Escalate precision if user uses security vocabulary |
Red flags — STOP
| Situation | Action |
|---|
| Live leaked credential in prod | Rotate first; then teach |
| Disable auth on prod "temporarily" | Warn; dev-only pattern |
| Store password plain text | Block ship until hashed |
User asks to commit .env | Refuse; teach .env.example |
Common mistakes
| Smell | Fix |
|---|
| Security through obscurity | Real auth + validation |
| Client-only validation | Duplicate on server |
| JWT in localStorage without understanding XSS | Teach tradeoff; httpOnly cookie alternative |
Required footer
---
DevLearn status: DONE | BLOCKED
Issues found: N
Critical: N
Suggested next: /devlearn-pre-ship | /devlearn-deploy | /devlearn-devops | rotate secrets
---
Additional resources
