security-baseline

Name: security-baseline
Availability: InStock
Author: Caleb

Enforce security baseline standards for headers, CSP, secrets, forms, cookies, PII, and accessibility.

Updated Apr 20, 2026

Search Tags:#security #qa #csp #baseline #policies #https #websites

Ready to run

npx skills add https://github.com/calebaero/website-factory --skill security-baseline-calebaero

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-baseline
Source: https://github.com/calebaero/website-factory/tree/main/skills/security-baseline
Command: npx skills add https://github.com/calebaero/website-factory --skill security-baseline-calebaero

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The security baseline provides a non-negotiable floor that every website produced by the website-factory workflow must meet, ensuring consistent protection across transports, headers, CSP, secrets handling, forms, cookies, PII, and accessibility.

Core Features & Use Cases

Establishes transport, header, and CSP standards for all archetypes (brochure, editable_brochure, app_lite).
Defines secret handling, anti-spam/form protections, and data minimization requirements to reduce risk.
Guides QA handoff with checklists and policy alignment to prevent deployment regressions.

Quick Start

Use the security baseline to validate and enforce the required headers, CSP, secret handling, forms protections, and data minimization across all site archetypes.

Frequently Asked Questions about security-baseline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is a website security baseline and what policies does it enforce?▼

A website security baseline enforces a non-negotiable protection floor across transports, CSP, secrets handling, forms, cookies, PII, and accessibility to satisfy policy standards and prevent deployment regressions.

How do I enforce CSP and HTTPS standards across different website archetypes?▼

Apply a security baseline across all archetypes, including brochure, editable_brochure, and app_lite, to define and enforce required CSP, HTTPS, and header standards during QA handoff.

Does my website project need a security baseline if it only collects basic form data?▼

Yes, a security baseline is required to enforce anti-spam form protections, data minimization, and PII handling policies across all archetypes, ensuring consistent protection even for basic sites.

What's the best way to prevent security regressions during website QA handoff?▼

The best way to prevent deployment regressions is to guide QA handoff with security baseline checklists that verify policy alignment for transport, headers, secrets, and accessibility.

Why do I need to validate cookies and PII handling before deploying my website?▼

Validating cookies and PII handling ensures your site meets the non-negotiable security baseline required to reduce risk, satisfy QA checks, and comply with established data minimization policies.