Security Engineer

Name: Security Engineer
Availability: InStock
Author: daffy0208

Mitigate application security vulnerabilities across authentication, authorization, and OWASP Top 10 scenarios.

34|7|Updated Oct 22, 2025

Search Tags:#authorization #OWASP #security #authentication #vulnerability #API security #data protection

Ready to run

npx skills add https://github.com/daffy0208/ai-dev-standards --skill security-engineer

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Security Engineer
Source: https://github.com/daffy0208/ai-dev-standards/tree/main/SKILLS/security-engineer
Command: npx skills add https://github.com/daffy0208/ai-dev-standards --skill security-engineer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bcrypt, jose, zod, multer, express-rate-limit, compression, helmet, express-mongo-sanitize, pg.

What problem does it solves? This Skill helps developers implement robust security measures from day one, preventing vulnerabilities, protecting sensitive user data, and reducing the risk of costly security breaches. It addresses the challenge of building secure applications without being a security expert.

Core Features & Use Cases

Authentication & Authorization: Implement secure JWT, session-based, or OAuth authentication and granular RBAC/ABAC authorization.
Vulnerability Prevention: Guides against OWASP Top 10 vulnerabilities like SQL Injection and XSS through input validation and secure coding practices.
Security Reviews: Provides checklists and workflows for conducting comprehensive security audits of existing applications.

Quick Start

Fastest path to secure app:

Authentication: Choose JWT, session-based, or OAuth
Input Validation: Use Zod/Yup to validate all user input
Parameterized Queries: Never concatenate SQL queries
Password Hashing: Use bcrypt (12+ rounds)
Security Headers: Set CSP, HSTS, X-Frame-Options
Rate Limiting: 5 login attempts per 15 minutes
HTTPS: Enforce TLS everywhere
Audit Logging: Log auth events and failures

Frequently Asked Questions about Security Engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement secure authentication in my application?▼

Secure authentication uses JWT, session-based, or OAuth methods combined with bcrypt password hashing (12+ rounds). Choose one approach, validate all input with Zod, enforce HTTPS, and log authentication events for audit trails.

What's the best way to prevent OWASP Top 10 vulnerabilities?▼

OWASP Top 10 prevention requires input validation with Zod, parameterized queries to block SQL injection, security headers (CSP, HSTS, X-Frame-Options), rate limiting, and helmet middleware. Apply these across authentication, authorization, and data handling.

How do I add rate limiting and security headers to an Express API?▼

Use express-rate-limit for login throttling (5 attempts per 15 minutes), helmet for automatic security headers, express-mongo-sanitize for input sanitization, and compression middleware. Configure HTTPS enforcement and audit logging for API endpoints.

Can I implement API security without being a security expert?▼

API security checklists and workflows guide you through authentication, authorization, input validation, encryption, and monitoring. Dependencies like bcrypt, jose, helmet, and rate-limit automate secure configuration; security reviews validate your implementation.

What role does encryption and secret management play in data protection?▼

Data protection combines encryption with secure secret management and parameterized database queries using PostgreSQL. Jose handles JWT encryption, bcrypt secures passwords, and audit logging tracks access to sensitive data throughout the application lifecycle.

How do I conduct a security audit of an existing application?▼

Security audits use comprehensive checklists covering authentication, authorization, input validation, encryption, rate limiting, HTTPS, and audit logging. Review each layer against OWASP guidelines and apply fixes incrementally with helmet, Zod validation, and monitoring.