What problem does it solve? Public-facing Spring Boot services are exposed to injection, misconfiguration, vulnerable dependencies, and leaked secrets, and teams often address these risks inconsistently across projects. ## Core Features & Use Cases - OWASP Top 10 Checklist for Spring Boot: Maps each risk (broken access control, injection, SSRF, and more) to concrete mitigations such as parameterized JPA queries, ArchUnit rules, and outbound host allow-lists. - Defense-in-depth Configuration: Provides ready patterns for input validation at every layer, deny-by-default CORS, bucket4j rate limiting, security response headers, and Actuator endpoint lockdown. - Supply Chain & Secrets Security: Covers dependency scanning with dependency-check-maven and Trivy, cosign image signing, SBOM generation, and secret management via Vault or cloud secret stores. - Use Case: Before exposing a new REST endpoint that handles customer data, apply this skill to add validation annotations, restrict CORS origins, configure rate limits, and verify CI fails on CVSS 7.0+ vulnerabilities. ## Quick Start Apply the security-hardening skill to review this Spring Boot service and add input validation, CORS restrictions, rate limiting, and security headers.
