security

name	security
description	Guides AI agents to write secure Fastify/Node.js code — input validation, authentication, injection prevention, and safe error handling.
metadata	{"tags":["security","fastify","nodejs","validation","auth"]}

Security Skill

Use this skill when writing any code that handles user input, authentication, authorization, or external data. Security rules apply to all features, not just auth-related ones.

When to Use

• Writing or reviewing route handlers that accept user input
• Implementing authentication or authorization logic
• Querying databases or calling external services with user-supplied data
• Handling file uploads or user-provided file paths
• Returning error messages to clients
• Setting HTTP headers or cookies

Rules

1. rules/input-validation.md — Validate and sanitize all input at the boundary using Fastify JSON Schema.
2. rules/injection.md — Prevent SQL, NoSQL, command, and path injection.
3. rules/auth.md — Authentication patterns: JWT verification, session hygiene, and authorization checks.
4. rules/error-handling.md — Safe error responses that never leak internals.
5. rules/headers.md — Secure HTTP headers and cookie attributes.

Quick Reference

• Always define a schema — Fastify rejects non-conforming input automatically
• Never expose internal errors to the client
• Authorization — always check ownership, not just authentication