skills.rest
jampissarandev
jampissarandevCOMMUNITY
Explore all skills by this author →
GitHub

security-and-hardening

Hardens web application code against OWASP vulnerabilities, injection, XSS, SSRF, and LLM threats.

Updated Jun 23, 2026
Search Tags:#security#authentication#input validation#owasp#threat modeling#hardening#ssrf
One-click install
npx skills add https://github.com/jampissarandev/Expense-Tracker --skill security-and-hardening-jampissarandev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/jampissarandev/Expense-Tracker/tree/main/.github/skills/security-and-hardening
Command: npx skills add https://github.com/jampissarandev/Expense-Tracker --skill security-and-hardening-jampissarandev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, broken access control, SSRF, and supply-chain attacks. This Skill provides a structured threat-modeling process and concrete prevention patterns so security is built into every feature rather than bolted on later. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run a quick STRIDE analysis before writing security controls, addressing OWASP A04 Insecure Design. - OWASP Prevention Patterns: Ready-to-use code patterns for parameterized queries, bcrypt password hashing, secure session cookies, CSP headers, CORS restriction, schema validation with Zod, and file upload safety. - SSRF and LLM Security: Defend server-side URL fetches with host allowlists and private-IP rejection, and treat LLM output as untrusted input per the OWASP LLM Top 10. - Use Case: When adding a webhook endpoint that fetches user-supplied URLs, apply the SSRF allowlist pattern to block requests to cloud metadata IPs like 169.254.169.254 before shipping. ## Quick Start Review my new API endpoint for security vulnerabilities and apply the appropriate hardening patterns from the security checklist.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in a web application?▼

Prevent SQL injection by using parameterized queries or an ORM instead of concatenating user input into SQL strings. Pass user values as bound parameters, for example db.query('SELECT * FROM users WHERE id = $1', [userId]).

How do I secure session cookies against XSS and CSRF?▼

Set session cookies with httpOnly, secure, and sameSite attributes so JavaScript cannot read them and cross-site requests cannot send them. Hash passwords with bcrypt at 12 or more salt rounds and never store tokens in localStorage.

How do I prevent SSRF when fetching user-supplied URLs?▼

Allowlist permitted hosts, require HTTPS, resolve all DNS records, and reject any address in private, loopback, or link-local ranges such as 169.254.169.254. Disable redirects and be aware of DNS-rebinding TOCTOU gaps on high-risk surfaces.

How should I triage npm audit vulnerabilities?▼

Triage by severity and reachability: fix critical or high findings immediately if the vulnerable code path is reachable, schedule moderate issues for the next release, and track low ones. Commit the lockfile and use npm ci in CI for reproducible builds.

What security risks come with LLM features in an app?▼

Treat all model output as untrusted input: never pass it to eval, SQL, shell, or innerHTML without validation and encoding. Keep secrets and other users' data out of prompts, scope tool permissions minimally, and cap token consumption.

When is threat modeling necessary for a feature?▼

Threat modeling is needed whenever a feature crosses a trust boundary, such as handling user input, file uploads, webhooks, or third-party APIs. A five-minute STRIDE pass over each boundary catches design flaws that code-level controls cannot fix later.

Related Skills

Explore More Software Engineering Skills→
yknothingyknothing
1

security-design

Codify security boundaries, threat models, and controls per architectural layer.

Community
Advanced
Fabric-ProFabric-Pro
3

threat-hunting

Detect security threats, vulnerabilities, and suspicious patterns in applications and infrastructure.

Official
Basic
mohitmishra786mohitmishra786

test

Generate unit, integration, and end-to-end tests with Pytest, Jest, Playwright, and k6.

Community
Advanced
wshaddixwshaddix
71

dotnet-blazor-auth

Implement authentication and authorization in Blazor applications with ASP.NET Core Identity.

Community
Advanced