What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, broken access control, and secret leakage. This Skill provides concrete security patterns and checklists so every feature touching untrusted data is built with defenses in place from the start. ## Core Features & Use Cases - OWASP Top 10 Prevention: Ready-to-use TypeScript patterns for parameterized queries, bcrypt password hashing, session cookie configuration, output encoding, and authorization checks. - Input Validation & Upload Safety: Zod schema validation at API boundaries plus file type and size restrictions for upload handlers. - Security Review Workflow: A three-tier boundary system (always do, ask first, never do), an npm audit triage decision tree, rate limiting setup, secrets management rules, and a pre-release security checklist. - Use Case: When adding a new API endpoint that accepts user data, apply the Skill to validate input with a schema, enforce ownership-based authorization, set security headers via helmet, and verify no secrets leak into responses or logs. ## Quick Start Review my new Express API endpoint for security issues and apply the hardening patterns from the security skill.
