security-and-hardening

The security-and-hardening skill is designed to help developers fortify their web applications against common vulnerabilities and security risks. It emphasizes a proactive security mindset, ensuring that every interaction with user data, authentication mechanisms, and external services is handled safely. By embedding security practices into the development process, this skill minimizes the risk of data breaches, unauthorized access, and exploitation of software weaknesses, particularly when dealing with untrusted input or sensitive information.

The skill provides a structured approach to security through clear guidelines, including the three-tier boundary system: actions that must always be performed, actions that require human approval, and practices that should never be done. Key capabilities include input validation, parameterized database queries, output encoding to prevent XSS, HTTPS enforcement, secure password hashing, security header configuration, safe session management, and audit checks. It also provides specific examples and code snippets for preventing top OWASP threats like injection attacks, broken authentication, XSS, and broken access control, helping developers implement these best practices consistently.

This skill is particularly valuable for developers building applications that handle user input, authentication, sensitive data, or integrate with external APIs. Target users include backend developers, full-stack engineers, and security-conscious teams working on web applications, APIs, or services that require robust defenses against common attacks. Use cases span from implementing secure authentication flows and session management to safely processing user-generated content and managing integrations with third-party services.