security-and-hardening

Harden web app code by enforcing input validation, parameterized queries, and secure configurations across APIs and auth flows.

1|Updated Jan 28, 2025

Search Tags:#security #authentication #input validation #owasp #hardening #secrets-management

Ready to run

npx skills add https://github.com/josuenavarroaguado/josuenavarroaguado.github.io --skill security-and-hardening-josuenavarroaguado

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/josuenavarroaguado/josuenavarroaguado.github.io/tree/main/.github/skills/security-and-hardening
Command: npx skills add https://github.com/josuenavarroaguado/josuenavarroaguado.github.io --skill security-and-hardening-josuenavarroaguado

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps developers eliminate common security vulnerabilities and misconfigurations by providing concise, actionable guidance for code, authentication, data handling, and third-party integrations.

Core Features & Use Cases

Boundary validation & sanitization: Validate and sanitize all external input at API routes and form handlers using schemas and type-safe validators.
Safe data handling: Use parameterized queries, avoid logging sensitive fields, hash passwords, and exclude secrets from responses and commits.
Auth, sessions & rate limiting: Implement secure session cookies, proper authentication flows, and stricter rate limits for auth endpoints.
Configuration & dependency hygiene: Enforce security headers, restrict CORS, run dependency audits, and manage secrets outside version control.
Use Case: Perform a security review of a new API endpoint, lock down session handling for an auth flow, or triage npm audit results before release.

Quick Start

Perform a security hardening review of the new /api/auth endpoint and produce a prioritized checklist of validations, headers, and configuration changes.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I harden web application authentication flows and session cookies?▼

Harden authentication flows by implementing secure session cookies, proper authentication checks, and stricter rate limits for auth endpoints. This prevents brute-force attacks and session hijacking by ensuring cookies have secure flags and auth routes are protected.

What is the best way to validate API route inputs to prevent vulnerabilities?▼

Validate API route inputs by applying schema-based, type-safe validators at all external boundaries. This boundary validation and sanitization process blocks malformed data early, preventing injection and ensuring only properly structured input reaches core logic.

How do I secure database queries against injection during code review?▼

Secure database queries by enforcing parameterized queries across all data storage interactions. This ensures user-supplied data is treated strictly as data values rather than executable SQL commands, neutralizing injection attacks during development and review.

How should I manage secrets and run dependency audits before deployment?▼

Manage secrets by excluding them from version control and API responses, and run dependency audits to identify vulnerable packages. This configuration and dependency hygiene prevents accidental secret leaks and ensures third-party libraries are safe before release.

What security headers and CORS restrictions should I enforce for API endpoints?▼

Enforce strict security headers and restrict CORS policies to trusted origins only. This limits cross-origin access to your API endpoints and mitigates common client-side attacks by ensuring browsers apply strict security policies to responses.

Can I use this approach to secure file uploads and third-party integrations?▼

Yes, you can secure file uploads and third-party integrations by validating external input and applying configuration hardening. This ensures uploaded files are sanitized and webhook payloads or integration data are strictly validated at the boundary.