security

Files (1)

• SKILL.md

SKILL.md (first lines)

# Security and Hardening

Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. This skill MUST apply security constraints to every line of code that touches user data, authentication, or external systems.

## What to Do

- Validate all external input at system boundaries.
- Parameterize all database queries.
- Encode output to prevent XSS; use framework auto-escaping.
- Hash passwords with bcrypt/scrypt/argon2 (salt rounds ≥ 12).
- Use httpOnly, secure, sameSite cookies for sessions.
- Check authorization on every protected endpoint.
- Set security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options).
- Use HTTPS for all external communication.
- Run dependency audits before release.
- Restrict CORS to known origins.
- Sanitize file uploads by type and size; do not trust extensions.

## Ask First

- Adding or changing authentication flows.
- Storing new categories of sensitive data.
- Adding external service integrations.
- Changing CORS configuration.
- Adding file upload handlers.
- Modifying rate limiting.
- Granting elevated permissions.

## Never Do

- Commit secrets to version control.
- Log sensitive data.
- Trust client-side validation as a security boundary.
- Disable security headers for convenience.
- Use `eval()` or `innerHTML` with user-provided data.
- Store sessions in client-accessible storage.
- Expose stack traces or internal errors to users.

## Process

1. Identify the attack surface (input points, auth, data flow).
2. Verify input validation exists at boundaries.
3. Check authorization on every affected endpoint.
4. Confirm secrets are not hardcoded or logged.
5. Verify security headers and transport security.
6. Run `npm audit` (or equivalent) and triage findings.

## Verification

- No critical or high vulnerabilities in dependencies.
- No secrets in source code or git history.
- All user input validated at system boundaries.
- Authentication and authorization checked on every protected endpoint.
- Security headers present in responses.
- Error responses do not expose internal details.
- Rate limiting active on authentication endpoints.

## Red Flags

- User input passed directly to database queries, shell commands, or HTML rendering.
- Secrets in source code or commit history.
- API endpoints without authentication or authorization checks.
- Wildcard (`*`) CORS origins.
- Missing rate limiting on authentication endpoints.
- Stack traces or internal errors exposed to users.
- Dependencies with known critical vulnerabilities.

From gc-victor/supersimple, MIT.

More from gc-victor/supersimple