skills.rest
CodeCrafterAdi2006
CodeCrafterAdi2006COMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities through threat modeling and defensive patterns.

Updated Jul 10, 2026
Search Tags:#security#authentication#input validation#owasp#threat modeling#hardening#ssrf
One-click install
npx skills add https://github.com/CodeCrafterAdi2006/Ink-and-Code --skill security-and-hardening-codecrafteradi2006
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/CodeCrafterAdi2006/Ink-and-Code/tree/main/Skills/security-and-hardening
Command: npx skills add https://github.com/CodeCrafterAdi2006/Ink-and-Code --skill security-and-hardening-codecrafteradi2006

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, SSRF, broken access control, and supply-chain attacks. This Skill provides a structured security review process so vulnerabilities are caught during development rather than after a breach. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run a five-minute STRIDE analysis before writing controls, addressing OWASP A04 Insecure Design. - OWASP Prevention Patterns: Copy-ready TypeScript patterns for parameterized queries, bcrypt password hashing, session cookie flags, CSP headers, CORS restriction, Zod input validation, and SSRF-safe URL fetching with DNS resolution checks. - AI/LLM Security Controls: Guidance mapped to the OWASP LLM Top 10 covering prompt injection, untrusted model output, excessive agency, and RAG tenant isolation. - Use Case: Before shipping a new webhook endpoint, use this Skill to validate the URL against an allowlist, reject private IP ranges, add rate limiting, and verify no secrets leak into logs. ## Quick Start Review my new API endpoint for security issues and apply the hardening checklist before I commit it.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]). ORMs like Prisma parameterize inputs automatically when you pass values through their query APIs.

How do I protect a server from SSRF attacks on webhook URLs?▼

Protect against SSRF by allowlisting schemes and hostnames, resolving all DNS records and rejecting any private or reserved IP ranges, and disabling redirects. For high-risk surfaces, pin the resolved IP or use a filtering agent since DNS rebinding can bypass check-then-fetch validation.

What session cookie settings should I use for authentication?▼

Session cookies should be httpOnly so JavaScript cannot read them, secure so they only travel over HTTPS, and sameSite set to lax or strict for CSRF protection. Hash passwords with bcrypt, scrypt, or argon2 and never store tokens in localStorage.

How do I triage npm audit vulnerabilities?▼

Triage npm audit results by severity and reachability: fix critical or high findings immediately if the vulnerable code path is reachable, schedule moderate fixes for the next release, and track low findings for routine updates. Document deferred fixes with a reason and review date.

Is LLM output safe to render or execute directly?▼

LLM output is untrusted input and must never go directly into eval, SQL, shell commands, or innerHTML. Parse it defensively with a schema validator like Zod, run only allowlisted actions, and render it as text content rather than markup.

When should I not rely on client-side validation?▼

Client-side validation is never a security boundary because attackers can bypass it with direct HTTP requests. Always re-validate all input at the server boundary using a schema library, and treat client checks only as a user experience convenience.

Related Skills

Explore More Software Engineering Skills→
thejefflarsonthejefflarson
20

threat-model

Identify missing security controls and gaps in system design before implementation.

Community
Advanced
paulundpaulund

security-reviewer

Identify and report security vulnerabilities in code, configurations, and infrastructure.

Community
Advanced
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced
achyutkneupaneachyutkneupane

spatie-security

Applies Spatie security guidelines to application, database, and server configuration reviews.

Community
Basic