skills.rest
kvithayathil
kvithayathilCOMMUNITY
Explore all skills by this author →
GitHub

security-best-practices

Implement OWASP Top 10 mitigations and HTTPS enforcement for web applications.

Updated Apr 14, 2026
Search Tags:#input validation#owasp#compliance#web security#api security#jwt authentication#csrf protection
One-click install
npx skills add https://github.com/kvithayathil/agent-resources --skill security-best-practices-kvithayathil
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-best-practices
Source: https://github.com/kvithayathil/agent-resources/tree/main/skills/security-best-practices
Command: npx skills add https://github.com/kvithayathil/agent-resources --skill security-best-practices-kvithayathil

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Web applications face frequent attacks exploiting common vulnerabilities like injection, XSS, broken authentication, and misconfiguration that lead to data breaches, regulatory fines, and reputational damage. This skill provides actionable, production-ready guidance to eliminate these risks.

Core Features & Use Cases

  • Full OWASP Top 10 Mitigation: Covers all 10 critical web application security risks with concrete implementation steps and verification checklists.
  • Production-Grade Hardening: Includes HTTPS enforcement, security headers via Helmet, rate limiting, input validation, CSRF protection, and secure JWT authentication with refresh token rotation.
  • Compliance Alignment: Meets requirements for GDPR, PCI-DSS, and other regulatory standards for public-facing applications. For example, a public e-commerce API can use this skill to pass security audits and block credential stuffing and injection attacks.

Quick Start

Use the security-best-practices skill to implement OWASP Top 10 mitigations, enforce HTTPS, and add secure JWT authentication to your new Express.js public API.

Frequently Asked Questions about security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I protect my web API against OWASP Top 10 vulnerabilities?▼

To protect a web API against OWASP Top 10 vulnerabilities, enforce HTTPS, implement security headers, validate inputs, and apply CSRF protection alongside JWT authentication with refresh token rotation.

What's the best way to implement JWT authentication with refresh token rotation?▼

The best way to implement JWT authentication with refresh token rotation is to pair it with strict input validation, CSRF protection, and secret management to eliminate broken authentication risks.

Can I use this approach to harden an existing Express.js application for compliance audits?▼

Yes, you can harden existing Express.js public APIs for compliance audits by applying production-grade security configurations that meet GDPR and PCI-DSS regulatory requirements.

Does input validation and CSRF protection prevent cross-site scripting and injection attacks?▼

Input validation prevents injection and cross-site scripting attacks by sanitizing incoming data, while CSRF protection blocks unauthorized commands transmitted from trusted users.

Why do I need security headers and HTTPS enforcement for public API hardening?▼

Security headers and HTTPS enforcement are required for public API hardening to prevent misconfiguration risks, block credential stuffing, and secure data in transit against breaches.

Related Skills

Explore More Software Engineering Skills→
PostHogPostHog
58

instrument-integration

Instrument PostHog SDKs across popular web and mobile frameworks with verified configuration.

Official
Advanced
qazuorqazuor

security-audit

Perform security audits covering OWASP Top 10, threat modeling, and code review.

Community
Advanced
flag3flag3
1

springboot-security

Analyze Spring Boot applications for authentication, authorization, and security posture.

Community
Advanced
SamuelSahaSamuelSaha

Zero Trust Implementation

Implement Zero Trust security with layered authentication, Zod validation, and RLS.

Community
Advanced