Security Best Practices Skill

Overview

This skill provides security guidelines following OWASP Top 10, secure coding patterns, authentication/authorization best practices, secrets management, and vulnerability prevention across multiple languages.

OWASP Top 10 Summary

1. •Injection - Use parameterized queries, never concatenate user input into SQL/commands
2. •Broken Authentication - Implement strong passwords, secure sessions, rate limiting
3. •Sensitive Data Exposure - Encrypt data at rest, use HTTPS, hash passwords
4. •XML External Entities (XXE) - Disable external entities in XML parsers
5. •Broken Access Control - Enforce authorization checks, implement resource-level controls
6. •Security Misconfiguration - Secure defaults, minimal privileges, regular updates
7. •Cross-Site Scripting (XSS) - Escape output, sanitize input, use CSP headers
8. •Insecure Deserialization - Use JSON instead of pickle, validate data
9. •Known Vulnerabilities - Regular dependency scanning, keep components updated
10. •Insufficient Logging - Log security events, monitor for anomalies

Quick Security Checklist

Input Validation

• • Validate all user input on server side
• • Use allowlists, not denylists
• • Sanitize data before display (prevent XSS)
• • Validate file uploads (type, size, extension)

Authentication

• • Use strong password requirements (12+ chars, complexity)
• • Hash passwords with bcrypt/Argon2 (not MD5/SHA1)
• • Implement rate limiting on login endpoints
• • Use secure session management (HttpOnly, Secure, SameSite)

Authorization

• • Check permissions on every request
• • Implement principle of least privilege
• • Use resource-level access controls
• • Never rely on client-side checks

Data Protection

• • Encrypt sensitive data at rest
• • Use TLS 1.2+ for all connections
• • Set security headers (HSTS, CSP, X-Frame-Options)
• • Never log sensitive data (passwords, tokens, PII)

Secrets Management

• • Use environment variables or secret managers
• • Never commit secrets to version control
• • Rotate secrets regularly
• • Use different secrets per environment

Common Vulnerabilities Prevention

SQL Injection

# ✅ SAFE: Parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

# ❌ UNSAFE: String concatenation
query = f"SELECT * FROM users WHERE id = '{user_id}'"

XSS Prevention

# ✅ SAFE: Template auto-escaping
return render_template('profile.html', username=username)

# ❌ UNSAFE: Raw HTML
return f"<div>{user_input}</div>"

Command Injection

# ✅ SAFE: Use list, not shell
subprocess.run(["ls", "-la", directory], shell=False)

# ❌ UNSAFE: Shell with user input
os.system(f"ls -la {directory}")

Language-Specific Patterns

See detailed guides in references/:

• •OWASP Top 10 Details - Comprehensive prevention for all 10 categories
• •Secure Coding - Python - Python-specific security patterns
• •Secure Coding - JavaScript - Node.js/Frontend security
• •Secure Coding - Go - Go security patterns
• •Secrets Management - AWS, Vault, GCP secret management

Security Headers

Always include these headers:

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'
Referrer-Policy: strict-origin-when-cross-origin

When to Use This Skill

Use this skill when:

• •Implementing authentication and authorization systems
• •Handling user input and data validation
• •Setting up HTTPS and security headers
• •Managing secrets and credentials
• •Configuring CORS and CSP policies
• •Reviewing code for security vulnerabilities
• •Setting up logging and monitoring
• •Configuring Docker and deployment security

Related Skills

• •@docker-patterns - Container security hardening
• •@ci-cd-pipelines - Security scanning in CI/CD
• •@api-rest-design - API security patterns
• •@postgresql-patterns - Database security
• •@feature-development - Secure development workflow