skills.rest
etylsarin
etylsarinCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-hardening

Implement authentication, authorization, CSP, input validation, and RLS policies.

59|12|Updated Feb 26, 2026
Search Tags:#authorization#security#authentication#rls#csp#input-validation#server-actions
One-click install
npx skills add https://github.com/etylsarin/opencastle --skill security-hardening-etylsarin
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-hardening
Source: https://github.com/etylsarin/opencastle/tree/main/src/orchestrator/skills/security-hardening
Command: npx skills add https://github.com/etylsarin/opencastle --skill security-hardening-etylsarin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams design and enforce security controls across the full web stack by providing actionable patterns for authentication, authorization, row-level security, content security policies, input validation, and API secrets management so applications resist common attack vectors and misconfigurations.

Core Features & Use Cases

  • Authentication & Session Management: Server Actions pattern, middleware refresh, HTTP-only cookies, and OAuth provider guidance for secure sign-in flows.
  • Authorization & RLS: Patterns for enabling RLS, example SQL practices, and role checks using auth.uid() to enforce row-level access.
  • API & Deployment Protections: Cron job authorization, CRON_SECRET usage, CSP and security header recommendations, and Zod-based input validation for server-side handlers.
  • Use Case: Audit an app to replace client-side checks with Server Actions, enable RLS on sensitive tables, and produce CSP and header configurations for production deployment.

Quick Start

Use the security-hardening skill to audit your codebase for auth, RLS, CSP, and input validation gaps and generate configuration and policy recommendations.

Frequently Asked Questions about security-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement row-level security policies using auth.uid() for database authorization?▼

Implement row-level security by enabling RLS on database tables and applying SQL policies that use auth.uid() to restrict row access based on the authenticated user's identity.

What is the best way to secure Server Actions with input validation and authentication checks?▼

Secure Server Actions by replacing client-side checks with server-side Zod validation schemas and applying robust authentication patterns, including HTTP-only cookies and middleware session refresh.

How do I configure Content Security Policy and HSTS headers for production web applications?▼

Configure Content Security Policy and HSTS headers by applying recommended security header configurations, including X-Frame-Options, to resist common attack vectors during production deployment.

Can I use CRON_SECRET to authorize scheduled API routes and cron jobs?▼

Yes, you can authorize scheduled API routes and cron jobs by implementing CRON_SECRET authorization checks, ensuring that only authenticated automated requests can trigger protected endpoints.

Does this security hardening approach work with OAuth providers for session management?▼

Yes, this security hardening approach works with OAuth providers by integrating provider guidance into the authentication flow, utilizing HTTP-only cookies and middleware refresh for secure session management.

What are the limitations of relying on client-side checks instead of Server Actions for authorization?▼

Relying on client-side checks exposes applications to misconfigurations and attack vectors; replacing them with Server Actions and Zod validation ensures input validation and authorization are enforced server-side.

Related Skills

Explore More Software Engineering Skills→
Tashima-TarshTashima-Tarsh
1

cyber-security

Review DISHA code changes for mandatory security controls.

Community
Intermediate
opsMachineopsMachine
1

supabase-security

Apply Supabase security best practices for RLS policies, auth, and edge functions.

Official
Advanced
SomtechSolutionMAximeSomtechSolutionMAxime

audit-rls

Audit PostgreSQL tables for missing or misconfigured Row-Level Security policies.

Community
Advanced
cenjiecenjie

api-security-hardening

Secure REST APIs with authentication, rate limiting, CORS, and input validation.

Community
Advanced