skills.rest
coagus
coagusCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-auditor

Identify and remediate security weaknesses in PHP REST APIs using OWASP Top 10.

2|Updated Feb 28, 2024
Search Tags:#security#oauth#jwt#owasp#audit#php-api
One-click install
npx skills add https://github.com/coagus/php-api-builder --skill security-auditor-coagus
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/coagus/php-api-builder/tree/main/.claude/skills/security-auditor
Command: npx skills add https://github.com/coagus/php-api-builder --skill security-auditor-coagus

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Application security vulnerabilities in PHP REST APIs are common and can lead to data breaches. This skill provides adversarial guidance to find and prevent security bugs, assess authentication/authorization, and ensure compliance with OWASP ASVS.

Core Features & Use Cases

  • OWASP Top 10 guidance: identify and mitigate core vulnerabilities across endpoints, auth flows, and data handling.
  • JWT/OAuth 2.1 security practices: enforce short-lived tokens, rotation for refresh tokens, and robust claim validation.
  • Secrets management & secure configuration: discourage hard-coded credentials; rely on environment stores and rotation strategies.
  • Secure coding & input sanitation: enforce proper validation, sanitization, secure headers, CORS, and logging hygiene.
  • Use Case: perform security reviews on PHP APIs to improve authentication, authorization, data handling, and deployment security posture.

Quick Start

Audit a PHP REST API project focusing on authentication, authorization, input handling, secret management, and dependency hygiene.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a PHP REST API for OWASP Top 10 vulnerabilities?▼

To audit a PHP REST API for OWASP Top 10 vulnerabilities, review authentication flows, authorization logic, input handling, and secrets management. Enforce proper token validation, safe file uploads, secure headers, and regular dependency auditing to remediate security weaknesses.

What is the best way to secure JWT and OAuth 2.1 in a PHP API?▼

Securing JWT and OAuth 2.1 in a PHP API requires enforcing short-lived tokens, implementing refresh token rotation, and applying robust claim validation. These modern authentication practices prevent unauthorized access and token replay attacks.

How does secrets management prevent credential leakage in PHP APIs?▼

Secrets management prevents credential leakage in PHP APIs by discouraging hard-coded credentials and relying on environment stores and rotation strategies. This approach ensures sensitive configuration data remains isolated from source code and version control.

Can I use this approach to check CORS and secure headers in PHP endpoints?▼

Yes, you can check CORS and secure headers in PHP endpoints using this approach. It enforces proper validation, input sanitization, secure headers, and logging hygiene to mitigate cross-origin resource sharing risks and exposure of sensitive data.

When do I need to perform a security review on my PHP API codebase?▼

You need to perform a security review on your PHP API codebase when assessing authentication, authorization, data handling, and deployment security posture. Regular audits ensure compliance with OWASP ASVS and prevent data breaches caused by application security vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
0xShe0xShe
386

php-route-mapper

Extract PHP web routes and parameter structures into Markdown files.

Community
Advanced
RepairYourTechRepairYourTech
6

security-scanning-security-hardening

Orchestrate multi-agent security hardening across application, infrastructure, and compliance domains.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

security-scanning-workflows

Automate SAST, dependency, and container security scans in CI/CD pipelines.

Official
Advanced
roanbrasilroanbrasil
5

api-gateway-design

Configure API gateways with authentication, rate limiting, and routing.

Community
Advanced