skills.rest
Scardubu
ScardubuCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-hardening-auditor

Audits and hardens Next.js and Node.js applications against OWASP Top 10 vulnerabilities.

1|Updated May 4, 2026
Search Tags:#input validation#rate limiting#owasp#security audit#next.js#auth.js#csp headers
One-click install
npx skills add https://github.com/Scardubu/SwarmXQ --skill security-hardening-auditor-scardubu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-hardening-auditor
Source: https://github.com/Scardubu/SwarmXQ/tree/main/.ai/skills/security-hardening-auditor
Command: npx skills add https://github.com/Scardubu/SwarmXQ --skill security-hardening-auditor-scardubu

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Full-stack applications ship with security gaps like broken access control, missing security headers, weak authentication, and unvalidated inputs. This Skill audits existing code against the OWASP Top 10 and generates production-ready configurations for authentication, headers, rate limiting, and secrets management. ## Core Features & Use Cases - OWASP Top 10 Audit: Walks through all 10 vulnerability categories and produces a severity-rated finding report with root causes and concrete remediations. - Auth.js v5 Setup: Generates complete NextAuth v5 configuration with Credentials and Google providers, JWT session callbacks, bcrypt password hashing, and middleware-based route protection. - Defense Configuration: Produces Content Security Policy and security headers, tiered rate limiting with Upstash Redis or Fastify, Zod input validation schemas, and startup-time secrets validation with @t3-oss/env-nextjs. - Use Case: Before launching a Next.js SaaS app, run a full security audit to catch missing ownership checks on resource fetches, then generate the auth, CSP, and rate limiting configs to close every finding. ## Quick Start Audit my Next.js application for OWASP Top 10 vulnerabilities and generate the Auth.js v5 setup with security headers and rate limiting.

Frequently Asked Questions about security-hardening-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up Auth.js v5 (NextAuth) in a Next.js app?▼

Install next-auth@beta and create an auth.ts file exporting handlers, signIn, signOut, and auth. Configure providers like Google and Credentials, use JWT session strategy with callbacks embedding user id and role, and export GET/POST handlers from app/api/auth/[...nextauth]/route.ts.

How do I add rate limiting to a Next.js or Fastify API?▼

Use @upstash/ratelimit with @upstash/redis for serverless Next.js routes, applying sliding window limits such as 5 attempts per 15 minutes on auth endpoints. For Fastify, register @fastify/rate-limit with a max count, time window, and IP-based key generator.

What security headers should a Next.js app have?▼

Set X-Frame-Options to DENY, X-Content-Type-Options to nosniff, Strict-Transport-Security with a one-year max-age, Referrer-Policy, Permissions-Policy, and a Content-Security-Policy restricting script, style, image, and connect sources. Configure them in next.config.ts and verify with securityheaders.com.

Does Prisma prevent SQL injection automatically?▼

Prisma parameterizes all standard queries by default, making them safe. Raw queries must use tagged template literals like $queryRaw with interpolated variables, which are parameterized. Never use $queryRawUnsafe with user-controlled input concatenated into the SQL string.

How do I validate environment variables and secrets in Next.js?▼

Use @t3-oss/env-nextjs with Zod to define a schema for server and client variables, requiring values like DATABASE_URL and a minimum 32-character AUTH_SECRET. The app throws at startup if any required variable is missing, and .env.local files must be gitignored.

Why is bcrypt limited to 72 characters for passwords?▼

bcrypt truncates input beyond 72 bytes, so passwords should be validated with a maximum length of 72 characters in the Zod schema. Hash with at least 12 salt rounds, which takes roughly 250 milliseconds on modern hardware and resists brute-force attacks.

Related Skills

Explore More Software Engineering Skills→
tranhieutttranhieutt
70

backend-security-coder

Harden Node.js and TypeScript backend APIs against injection and CSRF attacks.

Community
Advanced
Coverage-CreativesCoverage-Creatives

Playwright Testing

Automate end-to-end, component, and responsive web testing with Playwright.

Official
Advanced
whitebearditwhitebeardit
12

opentelemetry-instrumentation

Instrument Node.js and TypeScript applications with OpenTelemetry spans for distributed tracing.

Official
Advanced
narlyseorgnarlyseorg
6

stealth-techniques

Configure evasion patterns to bypass WAFs, IDS/IPS, and rate limits during authorized security testing.

Community
Advanced