skills.rest
calebaero
calebaeroCOMMUNITY
Explore all skills by this author →
GitHub

security-baseline

Enforce security baseline standards for headers, CSP, secrets, forms, cookies, PII, and accessibility.

Updated Apr 20, 2026
Search Tags:#security#qa#csp#baseline#policies#https#websites
One-click install
npx skills add https://github.com/calebaero/website-factory --skill security-baseline-calebaero
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-baseline
Source: https://github.com/calebaero/website-factory/tree/main/skills/security-baseline
Command: npx skills add https://github.com/calebaero/website-factory --skill security-baseline-calebaero

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The security baseline provides a non-negotiable floor that every website produced by the website-factory workflow must meet, ensuring consistent protection across transports, headers, CSP, secrets handling, forms, cookies, PII, and accessibility.

Core Features & Use Cases

  • Establishes transport, header, and CSP standards for all archetypes (brochure, editable_brochure, app_lite).
  • Defines secret handling, anti-spam/form protections, and data minimization requirements to reduce risk.
  • Guides QA handoff with checklists and policy alignment to prevent deployment regressions.

Quick Start

Use the security baseline to validate and enforce the required headers, CSP, secret handling, forms protections, and data minimization across all site archetypes.

Frequently Asked Questions about security-baseline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is a website security baseline and what policies does it enforce?▼

A website security baseline enforces a non-negotiable protection floor across transports, CSP, secrets handling, forms, cookies, PII, and accessibility to satisfy policy standards and prevent deployment regressions.

How do I enforce CSP and HTTPS standards across different website archetypes?▼

Apply a security baseline across all archetypes, including brochure, editable_brochure, and app_lite, to define and enforce required CSP, HTTPS, and header standards during QA handoff.

Does my website project need a security baseline if it only collects basic form data?▼

Yes, a security baseline is required to enforce anti-spam form protections, data minimization, and PII handling policies across all archetypes, ensuring consistent protection even for basic sites.

What's the best way to prevent security regressions during website QA handoff?▼

The best way to prevent deployment regressions is to guide QA handoff with security baseline checklists that verify policy alignment for transport, headers, secrets, and accessibility.

Why do I need to validate cookies and PII handling before deploying my website?▼

Validating cookies and PII handling ensures your site meets the non-negotiable security baseline required to reduce risk, satisfy QA checks, and comply with established data minimization policies.

Related Skills

Explore More Software Engineering Skills→
idomyhomeworkidomyhomework

website-intelligence

Analyze a client's brand and competitors to generate research files and an HTML design brief.

Community
Advanced
TheGoat395TheGoat395
117

final-client-handoff

Summarize project changes, commands, checks, URLs, environment variables, CMS notes, limitations, and next steps for website handoff.

Community
Advanced
ClearMeasureLabsClearMeasureLabs
3

owasp-dependency-scan

Scan .NET and npm dependencies for disclosed CVEs and generate consolidated security reports.

Official
Advanced
ryukyagamilightryukyagamilight
1

audit

Configure auditd and scan Linux systems for vulnerabilities and compliance issues.

Community
Advanced