skills.rest
NalinDalal
NalinDalalCOMMUNITY
Explore all skills by this author →
Website𝕏@nalin82929GitHub

security

Implements security headers, rate limiting, input validation, and authentication hardening for web applications.

1|Updated Aug 17, 2026
Search Tags:#security#authentication#input validation#rate limiting#CSP#secrets management#CORS
One-click install
npx skills add https://github.com/NalinDalal/skillset --skill security-nalindalal
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/NalinDalal/skillset/tree/main/skills/backend/security
Command: npx skills add https://github.com/NalinDalal/skillset --skill security-nalindalal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires zod, jose, @node-rs/argon2, @upstash/redis, redis, @node-rs/aes-gcm.

What problem does it solve? Web applications ship with common vulnerabilities like missing security headers, weak CORS policies, unvalidated inputs, and insecure session handling. This Skill provides concrete, copy-ready patterns for hardening an application against XSS, CSRF, clickjacking, brute-force attacks, and secret leakage. ## Core Features & Use Cases - Security Headers & CSP: Prebuilt Content Security Policy and full header checklist (HSTS, X-Frame-Options, COOP/COEP/CORP) with middleware implementation for Bun/Elysia. - Rate Limiting & Input Validation: Redis sliding-window rate limiter with per-route limits, plus Zod schemas for sanitizing strings, emails, passwords, and file uploads. - Auth Hardening & Secrets: Argon2id password hashing, short-lived JWTs with rotation, Redis-backed sessions, encryption at rest, and dependency auditing with bun audit. - Use Case: Before deploying a new API, apply the per-deploy security checklist to configure CSP in report-only mode, restrict CORS to known origins, add rate limits on auth endpoints, and verify bun audit passes. ## Quick Start Review my app's security posture and add security headers, rate limiting, and Zod input validation to all endpoints.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add security headers to a web application?▼

Set headers in middleware: Content-Security-Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy, HSTS, and COOP/CORP/COEP. Start CSP in report-only mode, then tighten with nonces for inline scripts.

How to implement rate limiting with Redis in Node.js?▼

Use a sliding-window algorithm with Redis sorted sets: remove expired entries, count current requests, add the new timestamp, and expire the key. Return 429 with Retry-After and X-RateLimit headers when the limit is exceeded.

What password hashing algorithm should I use for authentication?▼

Use Argon2id via @node-rs/argon2 with memoryCost around 19 MB, timeCost 2, and 32-byte output. Enforce passwords of 12-128 characters with uppercase, lowercase, number, and special character requirements per OWASP guidance.

Does CORS allow credentials with wildcard origin?▼

No, browsers reject Access-Control-Allow-Origin: * combined with credentials. Always whitelist specific origins like your app and admin domains, and only enable credentials when using cookie-based authentication.

Why should JWT access tokens be short-lived?▼

Short-lived access tokens (15 minutes) limit the damage window if a token is stolen. Pair them with 7-day refresh tokens stored in httpOnly cookies, and rotate refresh tokens on each use to detect reuse.

When should I apply NASA safety-critical coding rules?▼

Apply them in safety-critical or high-reliability software such as avionics, medical devices, and automotive systems. The rules restrict recursion, dynamic allocation after initialization, and unbounded loops, and require assertions and zero compiler warnings.

Related Skills

Explore More Software Engineering Skills→
GORKHAIGORKHAI

backend-platform

Build a Fastify, Prisma, Redis, and Stripe backend API scaffold with authentication and real-time channels.

Community
Advanced
pyoclawpyoclaw

security-and-hardening

Enforce validation, authentication, and secure configuration for web applications.

Community
Advanced
vovanostm-publicvovanostm-public

self-review

Reviews code diffs for architecture drift, secrets, stale code, and missing verification before handoff.

Official
Intermediate
AgentiveCityAgentiveCity
2

cloudflare-security-hardening

Configure WAF rules, rate limiting, IP lists, and secure headers for Cloudflare Workers APIs.

Official
Advanced