skills.rest
MaiconGambini
MaiconGambiniCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

backend-security-coder

Implements secure backend code covering input validation, authentication, API security, and database protection.

Updated Jul 29, 2026
Search Tags:#authentication#input validation#sql injection#owasp#secure coding#api security#backend security
One-click install
npx skills add https://github.com/MaiconGambini/opencode-harness-guide --skill backend-security-coder-maicongambini
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: backend-security-coder
Source: https://github.com/MaiconGambini/opencode-harness-guide/tree/main/skills/backend-security-coder
Command: npx skills add https://github.com/MaiconGambini/opencode-harness-guide --skill backend-security-coder-maicongambini

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Backend applications are exposed to injection attacks, broken authentication, CSRF, SSRF, and data leakage when security controls are missing or misconfigured. This Skill provides hands-on guidance for writing secure backend code that resists common attack vectors aligned with OWASP guidance. ## Core Features & Use Cases - Secure Coding Implementation: Input validation with allowlists, parameterized queries, context-aware output encoding, and secure error handling that avoids information leakage. - Authentication & API Security: JWT and OAuth 2.0/2.1 implementation, MFA, session management, rate limiting, RBAC/ABAC authorization, and CSRF protection. - Infrastructure & Data Protection: HTTP security headers, cookie hardening, database encryption and access control, secret management, and security logging. - Use Case: When building a new REST API endpoint, use this Skill to implement request validation, JWT authentication, rate limiting, and secure error responses in one pass. ## Quick Start Ask the agent to review your API endpoint for injection vulnerabilities and implement proper input validation and authentication.

Frequently Asked Questions about backend-security-coder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in backend code?▼

Use parameterized queries and prepared statements exclusively instead of string concatenation. Configure your ORM securely, enforce allowlist input validation, and apply least-privilege database user permissions to limit damage from any bypass.

How to implement secure JWT authentication with refresh tokens?▼

Verify JWT signatures on every request, set short token expirations, and rotate refresh tokens on each use. Store tokens securely, validate scopes for authorization, and invalidate sessions on logout or credential changes.

What is the difference between backend-security-coder and security-auditor?▼

Backend-security-coder focuses on hands-on secure coding: implementing validation, authentication, and API protections. Security-auditor handles high-level audits, compliance assessments, threat modeling, and penetration testing planning.

Which HTTP security headers should a web API set?▼

Set Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Combine these with HttpOnly, Secure, and SameSite cookie attributes plus strict CORS policies for credential-aware requests.

How do I prevent SSRF in server-side requests?▼

Validate and sanitize destination URLs, enforce destination allowlists, restrict protocols, and isolate internal networks. Add request timeouts, response size limits, and certificate validation to reduce exploitation impact.

When should I not use this skill for security work?▼

Avoid it for high-level security audits, compliance assessments, DevSecOps pipeline design, or penetration testing planning. Those tasks require an auditing-focused agent rather than a hands-on secure coding implementation skill.

Related Skills

Explore More Software Engineering Skills→
tswrtswr
1

security

Apply STRIDE threat modeling and language-specific mitigations to secure code.

Community
Advanced
awsaws
2.5k

remediating-with-aws-security-agent

Export AWS Security Agent findings and triage them into a prioritized remediation plan.

Official
Advanced
apexradiusapexradius

security-scan

Scan codebases for OWASP top 10 issues, exposed secrets, and dependency vulnerabilities.

Official
Intermediate
musher-devmusher-dev

shaping-reviewing-security

Review architecture sketches and API contracts for security risks and mitigations.

Official
Advanced