| name | Security Hardening |
| description | Use for auth, payments, secrets, file upload, webhooks, admin actions, database access, RLS, user-generated content, external APIs, and release review. |
| allowed-tools | Read, Bash, Edit, MultiEdit, Write |
Security Hardening
Use this skill for safety-critical code paths.
Review Focus
- Authn: user identity proven and session handling correct.
- Authz: user can only access own allowed resources.
- Secrets: no API keys, tokens, env values, or credentials in logs/client/git.
- Injection: SQL, command, template, path traversal, SSRF, XSS.
- Webhooks: signature verification, replay defense, idempotency.
- Uploads: type/size checks, storage path isolation, malware risk.
- Payments: server-side verification, no client-trusted price/status.
- Rate limits: abuse-prone endpoints protected.
Output
List findings by severity with file references and concrete fix. Do not invent vulnerabilities without evidence.