asepharyana-hub-guide/skills/security/SKILL.md

name, description

name	description
security	Security best practices for software development — input validation, authentication, authorization, secrets management, OWASP Top 10, and secure coding patterns. Use when handling user input, designing auth flows, storing secrets, configuring CORS/headers. Detects from code context and project files — not dependent on specific language keywords."

Security Best Practices

OWASP Top 10 (Quick Reference)

1. Broken Access Control — verify authorization for every action, not just login.
2. Cryptographic Failures — use modern crypto (AES-256-GCM, bcrypt/Argon2 for passwords, TLS 1.3).
3. Injection — never concatenate user input into SQL/shell/HTML. Use parameterized queries.
4. Insecure Design — threat model before building. Rate limit, throttle, validate.
5. Security Misconfiguration — remove defaults, disable debug in prod, use secure headers.
6. Vulnerable Components — keep dependencies updated. Use SCA tools (Dependabot, Renovate).
7. Auth Failures — MFA, rate-limit login, no weak passwords, secure session management.
8. Data Integrity Failures — signed JWTs, integrity checks on CI/CD pipeline.
9. Logging Failures — log auth failures, never log secrets, monitor suspicious patterns.
10. SSRF — validate URLs, restrict outbound network access.

Input Validation (First Line of Defense)

• Whitelist > blacklist — define what's allowed, not what's blocked.
• Validate at every trust boundary — API gateway → service → use case.
• Type coercion — parse, cast, then use. Never trust raw strings.
• Size limits — enforce max lengths, max file sizes.
• Content types — validate Content-Type and reject unexpected formats.

Authentication

• Passwords: bcrypt (cost ≥10), Argon2id, or PBKDF2. Never MD5/SHA1.
• JWTs: Use jose/jsonwebtoken with RS256 or ES256. Short TTL (15min access, 7d refresh max). Validate aud, iss, exp, nbf.
• Sessions: HttpOnly, Secure, SameSite=Strict cookies. Rotate on privilege change.
• MFA: Prefer TOTP/WebAuthn over SMS (SIM swap risk).
• Rate limiting: Login/registration/password-reset endpoints. 5 attempts/15min per IP is standard.

Authorization

• RBAC — roles assigned to users, permissions assigned to roles.
• ABAC (attribute-based) — for fine-grained: resource owner, department, region.
• Check every request — authorization at every endpoint, not just at login.
• Default deny — fail closed. If no rule allows it, deny it.
• Middleware pattern:

  // Authenticate → Authorize → Execute
  app.use('/api/*', authenticate);
  app.use('/api/admin/*', authorize('admin'));
  app.post('/api/orders', authorizeOrderAccess);
  

Secrets Management

• Never commit secrets. Use environment variables or a vault (Vault, AWS Secrets Manager, 1Password CLI).
• .env files — never committed to git. Use .env.example as a template.
• Scan for secrets — use trufflehog, git-secrets, or GitHub secret scanning.
• Rotate regularly — API keys, DB passwords, JWT signing keys.
• Principle of least privilege — tokens/secrets should have minimal scope.

API Security

Headers (via Traefik or middleware)

# Traefik example
middleware:
  secure-headers:
    headers:
      frameDeny: true
      contentTypeNosniff: true
      browserXssFilter: true
      sslRedirect: true
      referrerPolicy: "no-referrer-when-downgrade"
      permissionsPolicy: "camera=(), microphone=(), geolocation=()"
      customFrameOptionsValue: "SAMEORIGIN"
      contentSecurityPolicy: "default-src 'self'; script-src 'self'"

CORS

• Default: same-origin only.
• For APIs: whitelist specific origins, never Access-Control-Allow-Origin: * for authenticated endpoints.
• Credentials: Access-Control-Allow-Credentials: true only with explicit origin.

Rate Limiting

• Per IP, per user, per endpoint. Different limits for different tiers.
• Return 429 Too Many Requests with Retry-After header.
• Log rate limit hits — they often precede attacks.

Data Protection

• Encrypt at rest — AES-256-GCM for PII. Transparent encryption or app-level.
• Encrypt in transit — TLS 1.3 minimum. HSTS with max-age=63072000.
• PII minimization — don't collect what you don't need. Anonymize when possible.
• Data retention — delete old data. Have a purge policy.
• SQL injection prevention:

  // ❌ Never
  db.execute(`SELECT * FROM users WHERE id = '${id}'`);
  // ✅ Always
  db.execute('SELECT * FROM users WHERE id = $1', [id]);
  

XSS Prevention

• React/Vue/Svelte/Solid — auto-escaped by default. Avoid dangerouslySetInnerHTML/v-html.
• CSP headers — Content-Security-Policy restricts script sources.
• Never eval user input — JSON.parse is safe, eval is not.
• Sanitize HTML — use DOMPurify if you must render user HTML.

CSRF Prevention

• SameSite cookies — SameSite=Strict/Lax covers most cases.
• CSRF tokens — for forms without SameSite support.
• Custom headers — X-Requested-By is a valid CSRF token pattern for APIs.

Dependency Security

• Regular audits — npm audit, cargo audit, pip-audit.
• Lock files — commit package-lock.json, Cargo.lock, poetry.lock.
• Dependabot/Renovate — automate dependency updates.
• No * ranges — pin major/minor, allow patches.
• SBOM — generate Software Bill of Materials for production deployments.

Language-Specific

Language	Key Practice
TypeScript	strict: true, no any, use jose for JWT
Python	Use httpx/requests with TLS verify. Pydantic for validation
Rust	cargo audit, ring for crypto, parameterized queries via sqlx
Go	crypto stdlib, parameterized with database/sql, govulncheck