security

Generate OWASP-aligned security patterns for Spring Boot 4 and Angular 21 applications.

Updated Nov 17, 2025
One-click install
npx skills add https://github.com/Faouzi91/HomeFlex --skill security-faouzi91
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/Faouzi91/HomeFlex/tree/main/.claude/skills/security
Command: npx skills add https://github.com/Faouzi91/HomeFlex --skill security-faouzi91

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually implementing security for full-stack Spring Boot + Angular applications is error-prone and often leads to missed OWASP Top 10 vulnerabilities, data breaches, and compliance failures. This Skill eliminates that risk by providing pre-vetted, production-ready security patterns aligned with the HomeFlex architecture.

Core Features & Use Cases

  • Security Auditing & Hardening: Automatically scans code for OWASP Top 10 risks, misconfigurations, and insecure patterns in both Spring Boot backends and Angular frontends.
  • Compliant Implementation Generation: Provides ready-to-use code for httpOnly JWT cookies, CSRF protection, AES-256-GCM PII encryption, Redis rate limiting, and secure input validation that follows HomeFlex's security baseline.
  • Use Case: A developer building a rental platform can use this Skill to instantly add secure authentication, encrypt sensitive user PII, and implement rate limiting without missing critical security gaps.

Quick Start

Use the security skill to audit the HomeFlex property booking API for OWASP Top 10 compliance and add missing CSRF protection and rate limiting to all public endpoints.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement OWASP Top 10 security hardening for a Spring Boot and Angular full-stack application?

OWASP security hardening for Spring Boot and Angular is achieved by applying pre-vetted patterns for httpOnly JWT cookies, CSRF protection, AES-256-GCM PII encryption, and Redis rate limiting. This approach scans code for misconfigurations and generates compliant implementations aligned with production architecture standards.

What is the best way to set up secure authentication with httpOnly JWT cookies in Spring Boot and Angular?

Secure authentication with httpOnly JWT cookies in Spring Boot and Angular is implemented using pre-vetted security patterns that prevent client-side token access. This setup provides compliant code generation for httpOnly cookies alongside CSRF protection to secure rental platforms and similar production web apps.

How do I encrypt sensitive user PII using AES-256-GCM in a Spring Boot backend?

Encrypting sensitive user PII with AES-256-GCM in Spring Boot is done by applying pre-vetted OWASP-aligned security patterns. This provides ready-to-use implementations for encrypting personally identifiable information and secure secrets management to ensure data breach prevention.

Can I use Redis rate limiting to protect public API endpoints in a Spring Boot rental platform?

Redis rate limiting can protect public API endpoints in Spring Boot rental platforms by applying OWASP-aligned security patterns. This delivers compliant rate limiting implementations that prevent endpoint abuse and vulnerability exploitation without requiring manual configuration.

Does OWASP security auditing work with both Spring Boot backends and Angular frontends?

OWASP security auditing works with both Spring Boot backends and Angular frontends by automatically scanning code for insecure patterns and misconfigurations. It identifies OWASP Top 10 vulnerabilities across the full-stack application to deliver targeted remediation.

What are the limitations of manually implementing CSRF protection and input validation across a full-stack web app?

Manually implementing CSRF protection and input validation across a full-stack web app is error-prone and often leads to missed OWASP Top 10 vulnerabilities and compliance failures. Using pre-vetted security patterns eliminates manual risk by providing standardized, production-ready code.