Enforce secure coding practices for authentication, authorization, and secrets management.
npx skills add https://github.com/sumik5/dotfiles --skill auth-secrets
Please help me install this Agent Skill. Skill: AUTH-SECRETS Source: https://github.com/sumik5/dotfiles/tree/main/claude-code/skills/securing-code Command: npx skills add https://github.com/sumik5/dotfiles --skill auth-secrets
This guide covers authentication, authorization, password handling, and secret management to keep access controls robust.
Integrate secure password hashing and token generation in a new login flow.
High-intent search queries and answers about installing and using this skill.
Secure authentication uses password hashing algorithms like bcrypt or Argon2 to store credentials safely, combined with session management and token generation. This prevents credential exposure if your database is compromised and enforces proper login flows across your codebase.
Secrets management stores credentials, API keys, and tokens in environment-based vaults separate from source code, using encryption at rest and in transit. Access them through secure configuration during deployment to prevent accidental exposure in logs or repositories.
Role-based access control (RBAC) assigns permissions to user roles rather than individuals, then validates those roles on each request. This centralizes authorization logic, reduces vulnerabilities from hardcoded permissions, and scales across APIs and services.
Input validation checks that data matches expected format, type, and length before processing; sanitization removes or escapes potentially dangerous characters. Together they block injection attacks, XSS, and other OWASP-ranked vulnerabilities in APIs and codebases.
Security testing tools like CodeGuard scan code and deployments for authentication flaws, unencrypted secrets, and OWASP violations before release. Automation catches vulnerabilities early without slowing development cycles.
Encryption in transit uses TLS/SSL to protect data between clients and servers; secure headers like HSTS and CSP instruct browsers to enforce additional protections. Both are essential for APIs and web applications handling sensitive credentials and user data.
donnfelkerConfigures Kamal deploy.yml environment variables and secret management with per-host tags and role-specific settings.
BagelHoleImplement centralized audit logging with Fluentd and Elasticsearch.
ekremmkasapImplement JWT, OAuth2, and RBAC authentication for REST and GraphQL APIs.
moonshineTPImplement OAuth 2.0 and OpenID Connect flows with token management.
