skills.rest
fredericvahrenhorst
fredericvahrenhorstCOMMUNITY
Explore all skills by this author →
GitHub

security-review

A short, concise, and accurate description of the book.

Updated Jul 28, 2024
Search Tags:#authorization#security#authentication#input-validation#secrets-management#secure-coding#dependency-security
One-click install
npx skills add https://github.com/fredericvahrenhorst/share-app --skill security-review-fredericvahrenhorst
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/fredericvahrenhorst/share-app/tree/main/.cursor/skills/security-review
Command: npx skills add https://github.com/fredericvahrenhorst/share-app --skill security-review-fredericvahrenhorst

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill ensures codebases adhere to security best practices across authentication, input handling, secrets management, API design, and sensitive data handling, reducing vulnerabilities and production incidents.

Core Features & Use Cases

  • Secrets management: guidelines for storing secrets securely, environment variables, rotation, and avoiding hard-coded credentials.
  • Input validation & data sanitization: patterns and example code for validating and sanitizing user input to prevent injection and leakage.
  • Authentication & authorization: guidance on token handling, access controls, and secure session management.
  • API security & rate limiting: recommendations for securing endpoints, CSRF protection, and request throttling.
  • Error handling & logging: safe error messages and secure logging practices to avoid data leakage.
  • Dependency security: keeping dependencies up to date, auditing, and lockfile usage.
  • Threat modeling and secure-by-default patterns: general patterns to bake security into development workflows.
  • Use Case: In a typical web app, apply this skill during design reviews, PR reviews, and CI/CD checks to catch vulnerabilities before deployment.

Quick Start

Apply the security checklist to any new feature involving authentication, handling user input, secrets, API endpoints, or payment-related features.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce secure coding patterns for authentication and input validation?▼

Secure coding patterns are enforced by applying a comprehensive checklist covering token handling, access controls, and data sanitization. This validates user input and ensures secure session management to prevent injection attacks before production deployment.

What is the best way to manage secrets and prevent hard-coded credentials in my codebase?▼

Secrets management requires following guidelines for securely storing credentials, using environment variables, and implementing rotation. This approach avoids hard-coded credentials and reduces vulnerabilities across your application deployment pipelines.

How do I secure API endpoints with rate limiting and CSRF protection?▼

Secure API endpoints by implementing recommendations for request throttling and CSRF protection. This secures your API design against abusive traffic and cross-site request forgery, ensuring endpoints are protected during feature implementations.

Does this security review cover SQL injection prevention and XSS mitigation?▼

Yes, security review covers SQL injection prevention and XSS mitigation. It defines example snippets and secure defaults for input validation and data sanitization, ensuring vulnerabilities are caught during design reviews and CI/CD checks.

Can I apply a security checklist to catch vulnerabilities in CI/CD pipelines and PR reviews?▼

Yes, you can apply this security checklist to CI/CD pipelines and PR reviews. It evaluates error handling, secure logging, and dependency security, ensuring vulnerabilities are caught and secure defaults are followed before deployment.

Why does safe error handling and secure logging matter for preventing data leakage?▼

Safe error handling and secure logging matter because they prevent data leakage by avoiding sensitive information in error messages. This practice ensures secure defaults are followed and protects sensitive data across your application.

Related Skills

Explore More Software Engineering Skills→
SaturateSaturate

security-deep-dive

Analyze software security to identify vulnerabilities and attack surfaces.

Community
Advanced
chapzinchapzin
1

Security Audit

Audit code and infrastructure for security vulnerabilities and compliance gaps.

Community
Intermediate
ClearMeasureLabsClearMeasureLabs
3

owasp-dependency-scan

Scan .NET and npm dependencies for disclosed CVEs and generate consolidated security reports.

Official
Advanced
salmanabdurrahmansalmanabdurrahman

enum-waf-tech

Identify WAFs, CDNs, and bot-protection services via header and cookie analysis.

Community
Advanced