security-and-hardening

Name: security-and-hardening
Author: jmxt3

32stars3forks

How to install security-and-hardening?

jmxt3/gitscape.ai/security-and-hardening

$npx -y skills add jmxt3/gitscape.ai --skill security-and-hardening

Installs into the current project.

Summary

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

Files · 1

View on GitHub

SKILL.md

1	# Security and Hardening
2
3	## Overview
4
5	Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.
6
7	## When to Use
8
9	- Building anything that accepts user input
10	- Implementing authentication or authorization
11	- Storing or transmitting sensitive data
12	- Integrating with external APIs or services
13	- Adding file uploads, webhooks, or callbacks
14	- Handling payment or PII data
15
16	## The Three-Tier Boundary System
17
18	### Always Do (No Exceptions)
19
20	- Validate all external input at the system boundary (API routes, form handlers)
21	- Parameterize all database queries — never concatenate user input into SQL
22	- Encode output to prevent XSS (use framework auto-escaping, don't bypass it)
23	- Use HTTPS for all external communication
24	- Hash passwords with bcrypt/scrypt/argon2 (never store plaintext)
25	- Set security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
26	- Use httpOnly, secure, sameSite cookies for sessions
27	- Run `npm audit` (or equivalent) before every release
28
29	### Ask First (Requires Human Approval)
30
31	- Adding new authentication flows or changing auth logic
32	- Storing new categories of sensitive data (PII, payment info)
33	- Adding new external service integrations
34	- Changing CORS configuration
35	- Adding file upload handlers
36	- Modifying rate limiting or throttling
37	- Granting elevated permissions or roles
38
39	### Never Do
40
41	- Never commit secrets to version control (API keys, passwords, tokens)
42	- Never log sensitive data (passwords, tokens, full credit card numbers)
43	- Never trust client-side validation as a security boundary
44	- Never disable security headers for convenience
45	- Never use `eval()` or `innerHTML` with user-provided data
46	- Never store sessions in client-accessible storage (localStorage for auth tokens)
47	- Never expose stack traces or internal error details to users
48
49	## OWASP Top 10 Prevention
50
51	### 1. Injection (SQL, NoSQL, OS Command)
52
53	```typescript
54	// BAD: SQL injection via string concatenation
55	const query = `SELECT * FROM users WHERE id = '${userId}'`;
56
57	// GOOD: Parameterized query
58	const user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);
59
60	// GOOD: ORM with parameterized input
61	const user = await prisma.user.findUnique({ where: { id: userId } });
62	```
63
64	### 2. Broken Authentication
65
66	```typescript
67	// Password hashing
68	import { hash, compare } from 'bcrypt';
69
70	const SALT_ROUNDS = 12;
71	const hashedPassword = await hash(plaintext, SALT_ROUNDS);
72	const isValid = await compare(plaintext, hashedPassword);
73
74	// Session management
75	app.use(session({
76	secret: process.env.SESSION_SECRET, // From environment, not code
77	resave: false,
78	saveUninitialized: false,
79	cookie: {
80	httpOnly: true, // Not accessible via JavaScript
81	secure: true, // HTTPS only
82	sameSite: 'lax', // CSRF protection
83	maxAge: 24 * 60 * 60 * 1000, // 24 hours
84	},
85	}));
86	```
87
88	### 3. Cross-Site Scripting (XSS)
89
90	```typescript
91	// BAD: Rendering user input as HTML
92	element.innerHTML = userInput;
93
94	// GOOD: Use framework auto-escaping (React does this by default)
95	return <div>{userInput}</div>;
96
97	// If you MUST render HTML, sanitize first
98	import DOMPurify from 'dompurify';
99	const clean = DOMPurify.sanitize(userInput);
100	```
101
102	### 4. Broken Access Control
103
104	```typescript
105	// Always check authorization, not just authentication
106	app.patch('/api/tasks/:id', authenticate, async (req, res) => {
107	const task = await taskService.findById(req.params.id);
108
109	// Check that the authenticated user owns this resource
110	if (task.ownerId !== req.user.id) {
111	return res.status(403).json({
112	error: { code: 'FORBIDDEN', message: 'Not authorized to modify this task' }
113	});
114	}
115
116	// Proceed with update
117	const updated = await taskService.update(req.params.id, req.body);
118	return res.json(updated);
119	});
120	```
121
122	### 5. Security Misconfiguration
123
124	```typescript
125	// Security headers (use helmet for Express)
126	import helmet from 'helmet';
127	app.use(helmet());
128
129	// Content Security Policy
130	app.use(helmet.contentSecurityPolicy({
131	directives: {
132	defaultSrc: ["'self'"],
133	scriptSrc: ["'self'"],
134	styleSrc: ["'self'", "'unsafe-inline'"], // Tighten if possible
135	imgSrc: ["'self'", 'data:', 'https:'],
136	connectSrc: ["'self'"],
137	},
138	}));
139
140	// CORS — restrict to known origins
141	app.use(cors({
142	origin: process.env.ALLOWED_ORIGINS?.split(',') \|\| 'http://localhost:3000',
143	credentials: true,
144	}));
145	```
146
147	### 6. Sensitive Data Exposure
148
149	```typescript
150	// Never return sensitive fields in API

People who liked this also viewed

6 picks

Type

security-and-hardening

32stars3forks

View on GitHub

How to install security-and-hardening?

jmxt3/gitscape.ai/security-and-hardening

$npx -y skills add jmxt3/gitscape.ai --skill security-and-hardening

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Security and Hardening
2
3	## Overview
4
5	Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.
6
7	## When to Use
8
9	- Building anything that accepts user input
10	- Implementing authentication or authorization
11	- Storing or transmitting sensitive data
12	- Integrating with external APIs or services
13	- Adding file uploads, webhooks, or callbacks
14	- Handling payment or PII data
15
16	## The Three-Tier Boundary System
17
18	### Always Do (No Exceptions)
19
20	- Validate all external input at the system boundary (API routes, form handlers)
21	- Parameterize all database queries — never concatenate user input into SQL
22	- Encode output to prevent XSS (use framework auto-escaping, don't bypass it)
23	- Use HTTPS for all external communication
24	- Hash passwords with bcrypt/scrypt/argon2 (never store plaintext)
25	- Set security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
26	- Use httpOnly, secure, sameSite cookies for sessions
27	- Run `npm audit` (or equivalent) before every release
28
29	### Ask First (Requires Human Approval)
30
31	- Adding new authentication flows or changing auth logic
32	- Storing new categories of sensitive data (PII, payment info)
33	- Adding new external service integrations
34	- Changing CORS configuration
35	- Adding file upload handlers
36	- Modifying rate limiting or throttling
37	- Granting elevated permissions or roles
38
39	### Never Do
40
41	- Never commit secrets to version control (API keys, passwords, tokens)
42	- Never log sensitive data (passwords, tokens, full credit card numbers)
43	- Never trust client-side validation as a security boundary
44	- Never disable security headers for convenience
45	- Never use `eval()` or `innerHTML` with user-provided data
46	- Never store sessions in client-accessible storage (localStorage for auth tokens)
47	- Never expose stack traces or internal error details to users
48
49	## OWASP Top 10 Prevention
50
51	### 1. Injection (SQL, NoSQL, OS Command)
52
53	```typescript
54	// BAD: SQL injection via string concatenation
55	const query = `SELECT * FROM users WHERE id = '${userId}'`;
56
57	// GOOD: Parameterized query
58	const user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);
59
60	// GOOD: ORM with parameterized input
61	const user = await prisma.user.findUnique({ where: { id: userId } });
62	```
63
64	### 2. Broken Authentication
65
66	```typescript
67	// Password hashing
68	import { hash, compare } from 'bcrypt';
69
70	const SALT_ROUNDS = 12;
71	const hashedPassword = await hash(plaintext, SALT_ROUNDS);
72	const isValid = await compare(plaintext, hashedPassword);
73
74	// Session management
75	app.use(session({
76	secret: process.env.SESSION_SECRET, // From environment, not code
77	resave: false,
78	saveUninitialized: false,
79	cookie: {
80	httpOnly: true, // Not accessible via JavaScript
81	secure: true, // HTTPS only
82	sameSite: 'lax', // CSRF protection
83	maxAge: 24 * 60 * 60 * 1000, // 24 hours
84	},
85	}));
86	```
87
88	### 3. Cross-Site Scripting (XSS)
89
90	```typescript
91	// BAD: Rendering user input as HTML
92	element.innerHTML = userInput;
93
94	// GOOD: Use framework auto-escaping (React does this by default)
95	return <div>{userInput}</div>;
96
97	// If you MUST render HTML, sanitize first
98	import DOMPurify from 'dompurify';
99	const clean = DOMPurify.sanitize(userInput);
100	```
101
102	### 4. Broken Access Control
103
104	```typescript
105	// Always check authorization, not just authentication
106	app.patch('/api/tasks/:id', authenticate, async (req, res) => {
107	const task = await taskService.findById(req.params.id);
108
109	// Check that the authenticated user owns this resource
110	if (task.ownerId !== req.user.id) {
111	return res.status(403).json({
112	error: { code: 'FORBIDDEN', message: 'Not authorized to modify this task' }
113	});
114	}
115
116	// Proceed with update
117	const updated = await taskService.update(req.params.id, req.body);
118	return res.json(updated);
119	});
120	```
121
122	### 5. Security Misconfiguration
123
124	```typescript
125	// Security headers (use helmet for Express)
126	import helmet from 'helmet';
127	app.use(helmet());
128
129	// Content Security Policy
130	app.use(helmet.contentSecurityPolicy({
131	directives: {
132	defaultSrc: ["'self'"],
133	scriptSrc: ["'self'"],
134	styleSrc: ["'self'", "'unsafe-inline'"], // Tighten if possible
135	imgSrc: ["'self'", 'data:', 'https:'],
136	connectSrc: ["'self'"],
137	},
138	}));
139
140	// CORS — restrict to known origins
141	app.use(cors({
142	origin: process.env.ALLOWED_ORIGINS?.split(',') \|\| 'http://localhost:3000',
143	credentials: true,
144	}));
145	```
146
147	### 6. Sensitive Data Exposure
148
149	```typescript
150	// Never return sensitive fields in API

People who liked this also viewed

6 picks

Type