skills.rest
svssdeva
svssdevaCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-and-hardening

Harden web application code against injection, XSS, and insecure session handling.

1|1|Updated Apr 20, 2026
Search Tags:#authorization#security#input validation#rate limiting#xss#secrets management#hardening
One-click install
npx skills add https://github.com/svssdeva/agentic-skills --skill security-and-hardening-svssdeva
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/svssdeva/agentic-skills/tree/main/engineering/security-and-hardening
Command: npx skills add https://github.com/svssdeva/agentic-skills --skill security-and-hardening-svssdeva

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Security-and-hardening prevents common web application vulnerabilities by enforcing secure development habits at every boundary where untrusted input, secrets, or authorization decisions occur.

Core Features & Use Cases

  • Three-tier boundary rules: strict “Always Do” practices, “Ask First” review gates for risky changes, and explicit “Never Do” prohibitions to stop insecure patterns early.
  • Practical vulnerability coverage: injection prevention, broken authentication, XSS mitigation, and broken access control examples tailored to typical backend workflows.
  • Operational hardening: rate limiting, secrets management, dependency auditing, security headers, and error-handling guidance to reduce attack surface before deployment.

Quick Start

Use the security-and-hardening skill to review your API endpoints and user/session handling for missing validation, authorization, encoding, and secret-management mistakes.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent XSS and injection vulnerabilities in my web application code?▼

To prevent XSS and injection vulnerabilities, enforce parameterized queries, apply output encoding, and avoid unsafe patterns like eval and innerHTML with user-controlled data. This hardens application boundaries against untrusted input.

What is the best way to implement rate limiting and secrets management for API endpoints?▼

Implement rate limiting and secrets management by enforcing strict operational hardening rules at request and response boundaries. This reduces the attack surface by controlling external API integration access and sensitive data transmission.

How do I secure session handling and authorization logic in my backend?▼

Secure session handling and authorization by applying strict access control rules and secure cookie settings. Review authentication implementations to ensure untrusted input cannot bypass broken access controls.

Can I use this to audit dependencies and enforce security headers before deployment?▼

Yes, you can audit dependencies and enforce security headers before deployment. The skill provides operational hardening guidance to reduce attack surface and improve error-handling across your application boundaries.

Why does my web application still have broken access control after adding authentication?▼

Broken access control persists after authentication if authorization boundary logic allows untrusted input manipulation. Enforce strict review gates for risky changes and verify secure session settings to stop insecure patterns.

When should I not use unsafe patterns like eval and innerHTML with user data?▼

Never use unsafe patterns like eval and innerHTML with user-controlled data. These prohibitions stop insecure code execution early, preventing common cross-site scripting and injection vulnerabilities at the boundary.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-entry-point-analyzer

Map and analyze application entry points to assess security risk.

Official
Intermediate
stacksjsstacksjs
2

stacks-security-audit

Audit Stacks applications for attack surfaces, OWASP Top 10, STRIDE, and dependencies.

Official
Advanced
mitul-bhatiamitul-bhatia

perl-security

Harden Perl applications with taint mode, input validation, and parameterized DBI queries.

Community
Advanced
Solitude01Solitude01

1password

Manage 1Password CLI secrets and inject credentials in tmux sessions.

Community
Intermediate