secure-coding

name	secure-coding
description	Review code for security vulnerabilities and provide secure coding guidance across Go, Python, JavaScript, Java, Ruby, C#, and Swift. Triggers on code review, security questions, and vulnerability prevention.
allowed-tools	Bash Read Edit Glob Grep

Secure Coding

Proactively avoid generating vulnerable code. When writing, reviewing, or modifying code, check against the pattern tables in this skill to use safe alternatives instead of dangerous patterns.

When to Use

• Reviewing code for security issues
• Writing new code that handles user input, secrets, HTTP requests, file I/O, or crypto
• Answering "is this safe?" or "how do I securely..." questions
• Generating code that touches authentication, authorization, or data validation

When NOT to Use

• Writing xgrep detection rules (use xgrep-rule-creator skill)
• Triaging existing SAST scan findings (use xgrep-triage skill)
• Non-security code questions (algorithms, performance, etc.)

Detecting Intent

Code review: User shares code or asks to review a file/PR for security issues. Secure alternative: User asks how to do something safely ("how do I compare secrets in Go?"). Proactive: User is writing code that touches a security-sensitive area.

Quick Reference -- Most Critical Patterns

Never Do This

Pattern	Why	Safe Alternative
secret == expected	Timing attack	Constant-time compare (see patterns.md)
"SELECT * FROM t WHERE id=" + input	SQL injection	Parameterized queries
eval(user_input)	Code execution	json.loads(), ast.literal_eval()
requests.get(user_url)	SSRF	URL allowlist validation
open(user_filename)	Path traversal	os.path.basename() + join
pickle.load(data) / yaml.load(data)	Deserialization RCE	json.loads() / yaml.safe_load()
jwt.decode(token, secret) (no algorithms)	JWT alg confusion	jwt.decode(token, secret, algorithms=["HS256"])
InsecureSkipVerify: true	MitM attack	Remove or set false
Math.random() for tokens	Predictable	crypto.randomBytes()
tls.Config{MinVersion: tls.VersionTLS10}	Deprecated TLS	MinVersion: tls.VersionTLS12

References

• Full per-language pattern tables: references/patterns.md
• Real CVE code examples: references/cve-examples.md

Review Checklist

When reviewing code, check for these in order:

Security Review:
- [ ] Secret comparison uses constant-time function
- [ ] SQL queries use parameterized placeholders
- [ ] No eval/exec/compile on untrusted input
- [ ] HTTP requests validate URLs against allowlist
- [ ] File paths validated against base directory
- [ ] Deserialization uses safe loaders with type restrictions
- [ ] JWT decoding specifies allowed algorithms
- [ ] TLS >= 1.2, certificate validation enabled
- [ ] Crypto RNG used for security values (not math/rand)
- [ ] No secrets in log output
- [ ] CORS restricted to specific origins
- [ ] HTTP response headers don't include unsanitized user input
- [ ] File creation uses atomic mode setting (no chmod race)
- [ ] XSS: output encoded for context (HTML, JS, URL)