security-expert

# Security Expert Skill ## When to Use - Implementing authentication or authorization - Reviewing code for security vulnerabilities - Setting up security configurations - Handling sensitive data - Implementing encryption or hashing - Configuring CORS, CSP, or security headers - Reviewing dependencies for vulnerabilities - Implementing multi-tenancy or data isolation ## Project Context Discovery 1. Check `.agents/memory/` for security architecture notes and project facts 2. Review the agent instruction files (`AGENTS.md`/`CLAUDE.md`, repo-level and global) for security rules and "never do" constraints 3. Identify security patterns and tools 4. Check for `[project]-security-expert` skill ## Core Security Principles ### Authentication & Authorization **Authentication:** Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO **Authorization:** RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement ### Input Validation - DTOs with class-validator - Sanitize user input - Prevent NoSQL/SQL injection - Parameterized queries ### Data Protection - Encryption at rest and in transit - Passwords hashed (never plaintext) - Environment variables for secrets - No secrets in code ### Security Headers - X-Content-Type-Options: nosniff - X-Frame-Options: DENY - Strict-Transport-Security - Content Security Policy ## OWASP Top 10 Quick Reference 1. **Broken Access Control:** Verify auth on all endpoints 2. **Cryptographic Failures:** Strong encryption, proper hashing 3. **Injection:** Parameterized queries, input validation 4. **Insecure Design:** Security by design, threat modeling 5. **Security Misconfiguration:** Secure defaults, remove unused features 6. **Vulnerable Components:** Keep dependencies updated 7. **Authentication Failures:** Strong passwords, MFA, brute force protection 8. **Integrity Failures:** Secure CI/CD, code signing 9. **Logging Failures:** Comprehensive logging, monitoring 10. **SSRF:** Validate URLs, whitelist domains ## Security Checklist Summary - [ ] Passwords hashed (bcrypt/argon2) - [ ] All endpoints protected - [ ] Multi-tenancy enforced - [ ] All inputs validated - [ ] Encryption at rest/transit - [ ] Security headers configured - [ ] CORS properly configured - [ ] Dependencies up to date --- **For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see:** `references/full-guide.md`