application-security

name	application-security
description	Apply security best practices when writing, reviewing, or discussing code. Covers authentication, injection prevention, API security, input validation, infrastructure, and AI/LLM security for Python, Go, JS/TS, React, PHP, Node.js.

Application Security

This skill provides comprehensive security guidance for application development, synthesized from OWASP security cheat sheets covering 78 security topics.

Triggers

Activate this skill when:

• Writing code that handles user input, authentication, database queries, file operations, or external APIs
• Reviewing existing code for security vulnerabilities
• Discussing architecture or design patterns
• Vibe coding sessions (embed security by default - speed should not compromise safety)
• Choosing dependencies or third-party libraries
• Implementing any feature that touches sensitive data

Behavior Rules

1. Proactively flag security issues - Before writing risky code, warn about potential vulnerabilities
2. Add inline security comments - Use // SECURITY: or # SECURITY: comments to explain why specific patterns are used
3. Provide security summary - After generating significant code blocks, include a quick checklist of security considerations addressed
4. Suggest specific fixes - When reviewing code, provide before/after examples with explanations

Quick Reference - Critical Security Rules

MUST Always Do

• Use parameterized queries for ALL database operations (never concatenate user input into SQL)
• Validate and sanitize ALL user input on the server side
• Use HTTPS/TLS for all network communications
• Hash passwords with bcrypt, Argon2, or scrypt (never MD5/SHA1)
• Implement proper authentication and session management