Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
This skill is a defensive security checklist and pattern library that helps developers review code for common web vulnerabilities before shipping. It is intended to be activated when adding authentication or authorization, handling user input or file uploads, working with secrets, creating API endpoints, or implementing payment and other sensitive features. It addresses the problem of security oversights slipping into application code by providing a structured, category-by-category verification checklist with concrete pass/fail examples.
The skill walks through secrets management (keeping keys in environment variables rather than source, gitignoring env files), input validation with schema libraries, file-upload restrictions on size/type/extension, SQL-injection prevention via parameterized queries, authentication and authorization patterns (httpOnly cookies over localStorage, authorization checks before sensitive operations, Supabase Row Level Security policies), XSS prevention through HTML sanitization and Content Security Policy headers, CSRF protection with tokens and SameSite cookies, and rate limiting. Each section pairs a insecure anti-pattern labeled as something to avoid with a recommended secure implementation and a checklist of verification steps. A companion cloud-infrastructure-security reference is also included.
The target users are application developers and reviewers, primarily in TypeScript/Next.js and Supabase stacks, who want a repeatable secure-coding checklist. Use cases include pre-merge security reviews, hardening authentication flows, validating user input and uploads, and configuring security headers. The insecure snippets it shows are clearly marked as examples of what NOT to do; the skill's purpose is entirely defensive and educational.
Reviewing code against a security checklist and applying secure patterns for secrets, input validation, SQL injection, auth, XSS, CSRF, and rate limiting.
Examples are oriented toward TypeScript, Next.js, and Supabase, but the underlying principles (parameterized queries, env-var secrets, httpOnly cookies, CSP) apply broadly.
No. It shows insecure anti-patterns explicitly labeled as things to avoid, alongside the secure alternative; it is defensive guidance, not offensive tooling.
When implementing authentication, handling user input or file uploads, creating API endpoints, working with secrets, or building payment and other sensitive features.
It recommends storing all secrets in environment variables, keeping env files out of version control, avoiding secrets in git history, and using the hosting platform's secret store for production.
Quick Setup:
.claude/skills/Repository
affaan-m/ecc