security-hardening-checklist

Security headers audit scans your application for missing or misconfigured headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security. The Skill inspects your framework configuration and middleware to identify gaps, then recommends specific header values aligned with security best practices for your tech stack.

Cookie security validation checks for httpOnly, secure, and sameSite attributes. The Skill reviews your cookie configuration across the application, identifies missing protections against XSS and CSRF attacks, and provides actionable recommendations to harden cookie handling.

RLS policy audit examines your Row-Level Security implementation to ensure database access controls are correctly enforced. The Skill inspects RLS policies, identifies misconfigurations or gaps, and generates recommendations to strengthen data access restrictions.

Input sanitization audit discovers your project structure via Glob patterns, examines how user input is handled throughout your application, and checks validation practices. The Skill identifies unsafe input handling and recommends sanitization strategies for modern JavaScript frameworks.

Rate limiting inspection scans your API endpoints and middleware for rate limiting controls. The Skill identifies endpoints missing protections against abuse, reviews existing implementations, and recommends configurations to prevent denial-of-service attacks.

A security hardening report is a structured audit output covering headers, cookies, RLS policies, input sanitization, and rate limiting. It provides concrete, actionable recommendations ready for CI/CD integration and alignment with security best practices.