What problem does it solve? Applications that accept user input, manage sessions, or integrate external services ship with exploitable vulnerabilities when security is treated as an afterthought. This Skill enforces security-first development by providing threat modeling, hardening controls, and concrete code patterns for every feature that touches untrusted data. ## Core Features & Use Cases - Threat Modeling with STRIDE: Map trust boundaries, name assets, and run STRIDE analysis before writing code, covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. - OWASP Hardening Patterns: Concrete TypeScript implementations for injection prevention, bcrypt/argon2 password hashing, XSS output encoding, authorization checks, security headers, CORS restriction, SSRF defenses, and rate limiting with shared stores. - Supply Chain and Dependency Auditing: Triage package-manager audit findings by reachability, block unreviewed dependency install scripts, and verify lockfile integrity before releases. - Privacy and LLM Security: Classify personal data for GDPR/CCPA compliance, design deletion and export paths, and treat LLM output as untrusted input mapped to the OWASP LLM Top 10. - Use Case: When building a login flow, use this Skill to verify passwords are hashed with bcrypt, session cookies are httpOnly/secure/sameSite, auth endpoints are rate-limited, and the flow resists the OWASP Top Ten. ## Quick Start Audit my authentication endpoint and input handlers for OWASP Top Ten vulnerabilities and apply the hardening patterns.
