security-best-practices

Ask for a security review, audit, or vulnerability scan of your project. The skill identifies your languages and frameworks, loads matching reference guidance, and produces a severity-ranked markdown report with evidence, line numbers, and suggested fixes.

It supports Python, JavaScript/TypeScript, and Go, with dedicated reference files for frameworks such as Express and Go's net/http. If no matching reference exists, it falls back to well-known security best practices for that stack.

Yes, it checks for hardcoded credentials, committed .env files, and secrets in logs or Docker build args. It also recommends scanning tools like Gitleaks, TruffleHog, and detect-secrets, plus rotation and git history scrubbing when leaks are found.

Yes, it covers dependency auditing with npm audit, pip-audit, and govulncheck, lock file integrity, typosquatting detection, pinned versions in CI, and SBOM generation with CycloneDX tools.

Fixes are applied one finding at a time with minimal diffs and regression awareness. The skill explicitly avoids breaking changes, such as not forcing Secure cookie flags or TLS requirements in local development environments.

Missing TLS is not flagged in local development, testing, or when TLS is handled by an external reverse proxy. The skill only treats it as an issue for production deployments and recommends environment-based configuration instead.