[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6J28RY8KZPW5YRJKM6F425R":3,"skill-same:01M6J28RY8KZPW5YRJKM6F425R":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6J28RY8KZPW5YRJKM6F425R","security-and-hardening",null,"Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.","sampleXbro\u002Fagentsmesh","sampleXbro","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F55853222?v=4","01M6J1A11VAS9QEE92CHHMBCKC","Serhii Zhabskyi","01M6J1A16FCGNMMABYE0P6SNTF",29,"MIT","https:\u002F\u002Fgithub.com\u002FsampleXbro\u002Fagentsmesh\u002Fblob\u002Fmaster\u002F.claude\u002Fskills\u002Fsecurity-and-hardening\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"hardening","security","security and hardening","integrations","with","input","data storage","feature","third-party","use","user","data","services","authentication","code","sessions","storage","vulnerabilities","2026-11-10 10:12:30",false,"---\nname: security-and-hardening\ndescription: Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.\n---\n\n## Purpose\n\n# Security and Hardening\n\n## Overview\n\nSecurity-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.\n\n## When to Use\n\n- Building anything that accepts user input\n- Implementing authentication or authorization\n- Storing or transmitting sensitive data\n- Integrating with external APIs or services\n- Adding file uploads, webhooks, or callbacks\n- Handling payment or PII data\n\n## The Three-Tier Boundary System\n\n### Always Do (No Exceptions)\n\n- **Validate all external input** at the system boundary (API routes, form handlers)\n- **Parameterize all database queries** — never concatenate user input into SQL\n- **Encode output** to prevent XSS (use framework auto-escaping, don't bypass it)\n- **Use HTTPS** for all external communication\n- **Hash passwords** with bcrypt\u002Fscrypt\u002Fargon2 (never store plaintext)\n- **Set security headers** (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)\n- **Use httpOnly, secure, sameSite cookies** for sessions\n- **Run `npm audit`** (or equivalent) before every release\n\n### Ask First (Requires Human Approval)\n\n- Adding new authentication flows or changing auth logic\n- Storing new categories of sensitive data (PII, payment info)\n- Adding new external service integrations\n- Changing CORS configuration\n- Adding file upload handlers\n- Modifying rate limiting or throttling\n- Granting elevated permissions or roles\n\n### Never Do\n\n- **Never commit secrets** to version control (API keys, passwords, tokens)\n- **Never log sensitive data** (passwords, tokens, full credit card numbers)\n- **Never trust client-side validation** as a security boundary\n- **Never disable security headers** for convenience\n- **Never use `eval()` or `innerHTML`** with user-provided data\n- **Never store sessions in client-accessible storage** (localStorage for auth tokens)\n- **Never expose stack traces** or internal error details to users\n\n## OWASP Top 10 Prevention\n\n### 1. Injection (SQL, NoSQL, OS Command)\n\n```typescript\n\u002F\u002F BAD: SQL injection via string concatenation\nconst query = `SELECT * FROM users WHERE id = '${userId}'`;\n\n\u002F\u002F GOOD: Parameterized query\nconst user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);\n\n\u002F\u002F GOOD: ORM with parameterized input\nconst user = await prisma.user.findUnique({ where: { id: userId } });\n```\n\n### 2. Broken Authentication\n\n```typescript\n\u002F\u002F Password hashing\nimport { hash, compare } from 'bcrypt';\n\nconst SALT_ROUNDS = 12;\nconst hashedPassword = await hash(plaintext, SALT_ROUNDS);\nconst isValid = await compare(plaintext, hashedPassword);\n\n\u002F\u002F Session management\napp.use(session({\n  secret: process.env.SESSION_SECRET,  \u002F\u002F From environment, not code\n  resave: false,\n  saveUninitialized: false,\n  cookie: {\n    httpOnly: true,     \u002F\u002F Not accessible via JavaScript\n    secure: true,       \u002F\u002F HTTPS only\n    sameSite: 'lax',    \u002F\u002F CSRF protection\n    maxAge: 24 * 60 * 60 * 1000,  \u002F\u002F 24 hours\n  },\n}));\n```\n\n### 3. Cross-Site Scripting (XSS)\n\n```typescript\n\u002F\u002F BAD: Rendering user input as HTML\nelement.innerHTML = userInput;\n\n\u002F\u002F GOOD: Use framework auto-escaping (React does this by default)\nreturn \u003Cdiv>{userInput}\u003C\u002Fdiv>;\n\n\u002F\u002F If you MUST render HTML, sanitize first\nimport DOMPurify from 'dompurify';\nconst clean = DOMPurify.sanitize(userInput);\n```\n\n### 4. Broken Access Control\n\n```typescript\n\u002F\u002F Always check authorization, not just authentication\napp.patch('\u002Fapi\u002Ftasks\u002F:id', authenticate, async (req, res) => {\n  const task = await taskService.findById(req.params.id);\n\n  \u002F\u002F Check that the authenticated user owns this resource\n  if (task.ownerId !== req.user.id) {\n    return res.status(403).json({\n      error: { code: 'FORBIDDEN', message: 'Not authorized to modify this task' }\n    });\n  }\n\n  \u002F\u002F Proceed with update\n  const updated = await taskService.update(req.params.id, req.body);\n  return res.json(updated);\n});\n```\n\n### 5. Security Misconfiguration\n\n```typescript\n\u002F\u002F Security headers (use helmet for Express)\nimport helmet from 'helmet';\napp.use(helmet());\n\n\u002F\u002F Content Security Policy\napp.use(helmet.contentSecurityPolicy({\n  directives: {\n    defaultSrc: [\"'self'\"],\n    scriptSrc: [\"'self'\"],\n    styleSrc: [\"'self'\", \"'unsafe-inline'\"],  \u002F\u002F Tighten if possible\n    imgSrc: [\"'self'\", 'data:', 'https:'],\n    connectSrc: [\"'self'\"],\n  },\n}));\n\n\u002F\u002F CORS — restrict to known origins\napp.use(cors({\n  origin: process.env.ALLOWED_ORIGINS?.split(',') || 'http:\u002F\u002Flocalhost:3000',\n  credentials: true,\n}));\n```\n\n### 6. Sensitive Data Exposure\n\n```typescript\n\u002F\u002F Never return sensitive fields in API responses\nfunction sanitizeUser(user: UserRecord): PublicUser {\n  const { passwordHash, resetToken, ...publicFields } = user;\n  return publicFields;\n}\n\n\u002F\u002F Use environment variables for secrets\nconst API_KEY = process.env.STRIPE_API_KEY;\nif (!API_KEY) throw new Error('STRIPE_API_KEY not configured');\n```\n\n## Input Validation Patterns\n\n### Schema Validation at Boundaries\n\n```typescript\nimport { z } from 'zod';\n\nconst CreateTaskSchema = z.object({\n  title: z.string().min(1).max(200).trim(),\n  description: z.string().max(2000).optional(),\n  priority: z.enum(['low', 'medium', 'high']).default('medium'),\n  dueDate: z.string().datetime().optional(),\n});\n\n\u002F\u002F Validate at the route handler\napp.post('\u002Fapi\u002Ftasks', async (req, res) => {\n  const result = CreateTaskSchema.safeParse(req.body);\n  if (!result.success) {\n    return res.status(422).json({\n      error: {\n        code: 'VALIDATION_ERROR',\n        message: 'Invalid input',\n        details: result.error.flatten(),\n      },\n    });\n  }\n  \u002F\u002F result.data is now typed and validated\n  const task = await taskService.create(result.data);\n  return res.status(201).json(task);\n});\n```\n\n### File Upload Safety\n\n```typescript\n\u002F\u002F Restrict file types and sizes\nconst ALLOWED_TYPES = ['image\u002Fjpeg', 'image\u002Fpng', 'image\u002Fwebp'];\nconst MAX_SIZE = 5 * 1024 * 1024; \u002F\u002F 5MB\n\nfunction validateUpload(file: UploadedFile) {\n  if (!ALLOWED_TYPES.includes(file.mimetype)) {\n    throw new ValidationError('File type not allowed');\n  }\n  if (file.size > MAX_SIZE) {\n    throw new ValidationError('File too large (max 5MB)');\n  }\n  \u002F\u002F Don't trust the file extension — check magic bytes if critical\n}\n```\n\n## Triaging npm audit Results\n\nNot all audit findings require immediate action. Use this decision tree:\n\n```\nnpm audit reports a vulnerability\n├── Severity: critical or high\n│   ├── Is the vulnerable code reachable in your app?\n│   │   ├── YES --> Fix immediately (update, patch, or replace the dependency)\n│   │   └── NO (dev-only dep, unused code path) --> Fix soon, but not a blocker\n│   └── Is a fix available?\n│       ├── YES --> Update to the patched version\n│       └── NO --> Check for workarounds, consider replacing the dependency, or add to allowlist with a review date\n├── Severity: moderate\n│   ├── Reachable in production? --> Fix in the next release cycle\n│   └── Dev-only? --> Fix when convenient, track in backlog\n└── Severity: low\n    └── Track and fix during regular dependency updates\n```\n\n**Key questions:**\n- Is the vulnerable function actually called in your code path?\n- Is the dependency a runtime dependency or dev-only?\n- Is the vulnerability exploitable given your deployment context (e.g., a server-side vulnerability in a client-only app)?\n\nWhen you defer a fix, document the reason and set a review date.\n\n## Rate Limiting\n\n```typescript\nimport rateLimit from 'express-rate-limit';\n\n\u002F\u002F General API rate limit\napp.use('\u002Fapi\u002F', rateLimit({\n  windowMs: 15 * 60 * 1000, \u002F\u002F 15 minutes\n  max: 100,                   \u002F\u002F 100 requests per window\n  standardHeaders: true,\n  legacyHeaders: false,\n}));\n\n\u002F\u002F Stricter limit for auth endpoints\napp.use('\u002Fapi\u002Fauth\u002F', rateLimit({\n  windowMs: 15 * 60 * 1000,\n  max: 10,  \u002F\u002F 10 attempts per 15 minutes\n}));\n```\n\n## Secrets Management\n\n```\n.env files:\n  ├── .env.example  → Committed (template with placeholder values)\n  ├── .env          → NOT committed (contains real secrets)\n  └── .env.local    → NOT committed (local overrides)\n\n.gitignore must include:\n  .env\n  .env.local\n  .env.*.local\n  *.pem\n  *.key\n```\n\n**Always check before committing:**\n```bash\n# Check for accidentally staged secrets\ngit diff --cached | grep -i \"password\\|secret\\|api_key\\|token\"\n```\n\n## Security Review Checklist\n\n```markdown\n### Authentication\n- [ ] Passwords hashed with bcrypt\u002Fscrypt\u002Fargon2 (salt rounds ≥ 12)\n- [ ] Session tokens are httpOnly, secure, sameSite\n- [ ] Login has rate limiting\n- [ ] Password reset tokens expire\n\n### Authorization\n- [ ] Every endpoint checks user permissions\n- [ ] Users can only access their own resources\n- [ ] Admin actions require admin role verification\n\n### Input\n- [ ] All user input validated at the boundary\n- [ ] SQL queries are parameterized\n- [ ] HTML output is encoded\u002Fescaped\n\n### Data\n- [ ] No secrets in code or version control\n- [ ] Sensitive fields excluded from API responses\n- [ ] PII encrypted at rest (if applicable)\n\n### Infrastructure\n- [ ] Security headers configured (CSP, HSTS, etc.)\n- [ ] CORS restricted to known origins\n- [ ] Dependencies audited for vulnerabilities\n- [ ] Error messages don't expose internals\n```\n## See Also\n\nFor detailed security checklists and pre-commit verification steps, see `references\u002Fsecurity-checklist.md`.\n\n## Common Rationalizations\n\n| Rationalization | Reality |\n|---|---|\n| \"This is an internal tool, security doesn't matter\" | Internal tools get compromised. Attackers target the weakest link. |\n| \"We'll add security later\" | Security retrofitting is 10x harder than building it in. Add it now. |\n| \"No one would try to exploit this\" | Automated scanners will find it. Security by obscurity is not security. |\n| \"The framework handles security\" | Frameworks provide tools, not guarantees. You still need to use them correctly. |\n| \"It's just a prototype\" | Prototypes become production. Security habits from day one. |\n\n## Red Flags\n\n- User input passed directly to database queries, shell commands, or HTML rendering\n- Secrets in source code or commit history\n- API endpoints without authentication or authorization checks\n- Missing CORS configuration or wildcard (`*`) origins\n- No rate limiting on authentication endpoints\n- Stack traces or internal errors exposed to users\n- Dependencies with known critical vulnerabilities\n\n## Verification\n\nAfter implementing security-relevant code:\n\n- [ ] `npm audit` shows no critical or high vulnerabilities\n- [ ] No secrets in source code or git history\n- [ ] All user input validated at system boundaries\n- [ ] Authentication and authorization checked on every protected endpoint\n- [ ] Security headers present in response (check with browser DevTools)\n- [ ] Error responses don't expose internal details\n- [ ] Rate limiting active on auth endpoints","## Purpose\n\n# Security and Hardening\n\n## Overview\n\nSecurity-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.\n\n## When to Use\n\n- Building anything that accepts user input\n- Implementing authentication or authorization\n- Storing or transmitting sensitive data\n- Integrating with external APIs or services\n- Adding file uploads, webhooks, or callbacks\n- Handling payment or PII data\n\n## The Three-Tier Boundary System\n\n### Always Do (No Exceptions)\n\n- **Validate all external input** at the system boundary (API routes, form handlers)\n- **Parameterize all database queries** — never concatenate user input into SQL\n- **Encode output** to prevent XSS (use framework auto-escaping, don't bypass it)\n- **Use HTTPS** for all external communication\n- **Hash passwords** with bcrypt\u002Fscrypt\u002Fargon2 (never store plaintext)\n- **Set security headers** (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)\n- **Use httpOnly, secure, sameSite cookies** for sessions\n- **Run `npm audit`** (or equivalent) before every release\n\n### Ask First (Requires Human Approval)\n\n- Adding new authentication flows or changing auth logic\n- Storing new categories of sensitive data (PII, payment info)\n- Adding new external service integrations\n- Changing CORS configuration\n- Adding file upload handlers\n- Modifying rate limiting or throttling\n- Granting elevated permissions or roles\n\n### Never Do\n\n- **Never commit secrets** to version control (API keys, passwords, tokens)\n- **Never log sensitive data** (passwords, tokens, full credit card numbers)\n- **Never trust client-side validation** as a security boundary\n- **Never disable security headers** for convenience\n- **Never use `eval()` or `innerHTML`** with user-provided data\n- **Never store sessions in client-accessible storage** (localStorage for auth tokens)\n- **Never expose stack traces** or internal error details to users\n\n## OWASP Top 10 Prevention\n\n### 1. Injection (SQL, NoSQL, OS Command)\n\n```typescript\n\u002F\u002F BAD: SQL injection via string concatenation\nconst query = `SELECT * FROM users WHERE id = '${userId}'`;\n\n\u002F\u002F GOOD: Parameterized query\nconst user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);\n\n\u002F\u002F GOOD: ORM with parameterized input\nconst user = await prisma.user.findUnique({ where: { id: userId } });\n```\n\n### 2. Broken Authentication\n\n```typescript\n\u002F\u002F Password hashing\nimport { hash, compare } from 'bcrypt';\n\nconst SALT_ROUNDS = 12;\nconst hashedPassword = await hash(plaintext, SALT_ROUNDS);\nconst isValid = await compare(plaintext, hashedPassword);\n\n\u002F\u002F Session management\napp.use(session({\n  secret: process.env.SESSION_SECRET,  \u002F\u002F From environment, not code\n  resave: false,\n  saveUninitialized: false,\n  cookie: {\n    httpOnly: true,     \u002F\u002F Not accessible via JavaScript\n    secure: true,       \u002F\u002F HTTPS only\n    sameSite: 'lax',    \u002F\u002F CSRF protection\n    maxAge: 24 * 60 * 60 * 1000,  \u002F\u002F 24 hours\n  },\n}));\n```\n\n### 3. Cross-Site Scripting (XSS)\n\n```typescript\n\u002F\u002F BAD: Rendering user input as HTML\nelement.innerHTML = userInput;\n\n\u002F\u002F GOOD: Use framework auto-escaping (React does this by default)\nreturn \u003Cdiv>{userInput}\u003C\u002Fdiv>;\n\n\u002F\u002F If you MUST render HTML, sanitize first\nimport DOMPurify from 'dompurify';\nconst clean = DOMPurify.sanitize(userInput);\n```\n\n### 4. Broken Access Control\n\n```typescript\n\u002F\u002F Always check authorization, not just authentication\napp.patch('\u002Fapi\u002Ftasks\u002F:id', authenticate, async (req, res) => {\n  const task = await taskService.findById(req.params.id);\n\n  \u002F\u002F Check that the authenticated user owns this resource\n  if (task.ownerId !== req.user.id) {\n    return res.status(403).json({\n      error: { code: 'FORBIDDEN', message: 'Not authorized to modify this task' }\n    });\n  }\n\n  \u002F\u002F Proceed with update\n  const updated = await taskService.update(req.params.id, req.body);\n  return res.json(updated);\n});\n```\n\n### 5. Security Misconfiguration\n\n```typescript\n\u002F\u002F Security headers (use helmet for Express)\nimport helmet from 'helmet';\napp.use(helmet());\n\n\u002F\u002F Content Security Policy\napp.use(helmet.contentSecurityPolicy({\n  directives: {\n    defaultSrc: [\"'self'\"],\n    scriptSrc: [\"'self'\"],\n    styleSrc: [\"'self'\", \"'unsafe-inline'\"],  \u002F\u002F Tighten if possible\n    imgSrc: [\"'self'\", 'data:', 'https:'],\n    connectSrc: [\"'self'\"],\n  },\n}));\n\n\u002F\u002F CORS — restrict to known origins\napp.use(cors({\n  origin: process.env.ALLOWED_ORIGINS?.split(',') || 'http:\u002F\u002Flocalhost:3000',\n  credentials: true,\n}));\n```\n\n### 6. Sensitive Data Exposure\n\n```typescript\n\u002F\u002F Never return sensitive fields in API responses\nfunction sanitizeUser(user: UserRecord): PublicUser {\n  const { passwordHash, resetToken, ...publicFields } = user;\n  return publicFields;\n}\n\n\u002F\u002F Use environment variables for secrets\nconst API_KEY = process.env.STRIPE_API_KEY;\nif (!API_KEY) throw new Error('STRIPE_API_KEY not configured');\n```\n\n## Input Validation Patterns\n\n### Schema Validation at Boundaries\n\n```typescript\nimport { z } from 'zod';\n\nconst CreateTaskSchema = z.object({\n  title: z.string().min(1).max(200).trim(),\n  description: z.string().max(2000).optional(),\n  priority: z.enum(['low', 'medium', 'high']).default('medium'),\n  dueDate: z.string().datetime().optional(),\n});\n\n\u002F\u002F Validate at the route handler\napp.post('\u002Fapi\u002Ftasks', async (req, res) => {\n  const result = CreateTaskSchema.safeParse(req.body);\n  if (!result.success) {\n    return res.status(422).json({\n      error: {\n        code: 'VALIDATION_ERROR',\n        message: 'Invalid input',\n        details: result.error.flatten(),\n      },\n    });\n  }\n  \u002F\u002F result.data is now typed and validated\n  const task = await taskService.create(result.data);\n  return res.status(201).json(task);\n});\n```\n\n### File Upload Safety\n\n```typescript\n\u002F\u002F Restrict file types and sizes\nconst ALLOWED_TYPES = ['image\u002Fjpeg', 'image\u002Fpng', 'image\u002Fwebp'];\nconst MAX_SIZE = 5 * 1024 * 1024; \u002F\u002F 5MB\n\nfunction validateUpload(file: UploadedFile) {\n  if (!ALLOWED_TYPES.includes(file.mimetype)) {\n    throw new ValidationError('File type not allowed');\n  }\n  if (file.size > MAX_SIZE) {\n    throw new ValidationError('File too large (max 5MB)');\n  }\n  \u002F\u002F Don't trust the file extension — check magic bytes if critical\n}\n```\n\n## Triaging npm audit Results\n\nNot all audit findings require immediate action. Use this decision tree:\n\n```\nnpm audit reports a vulnerability\n├── Severity: critical or high\n│   ├── Is the vulnerable code reachable in your app?\n│   │   ├── YES --> Fix immediately (update, patch, or replace the dependency)\n│   │   └── NO (dev-only dep, unused code path) --> Fix soon, but not a blocker\n│   └── Is a fix available?\n│       ├── YES --> Update to the patched version\n│       └── NO --> Check for workarounds, consider replacing the dependency, or add to allowlist with a review date\n├── Severity: moderate\n│   ├── Reachable in production? --> Fix in the next release cycle\n│   └── Dev-only? --> Fix when convenient, track in backlog\n└── Severity: low\n    └── Track and fix during regular dependency updates\n```\n\n**Key questions:**\n- Is the vulnerable function actually called in your code path?\n- Is the dependency a runtime dependency or dev-only?\n- Is the vulnerability exploitable given your deployment context (e.g., a server-side vulnerability in a client-only app)?\n\nWhen you defer a fix, document the reason and set a review date.\n\n## Rate Limiting\n\n```typescript\nimport rateLimit from 'express-rate-limit';\n\n\u002F\u002F General API rate limit\napp.use('\u002Fapi\u002F', rateLimit({\n  windowMs: 15 * 60 * 1000, \u002F\u002F 15 minutes\n  max: 100,                   \u002F\u002F 100 requests per window\n  standardHeaders: true,\n  legacyHeaders: false,\n}));\n\n\u002F\u002F Stricter limit for auth endpoints\napp.use('\u002Fapi\u002Fauth\u002F', rateLimit({\n  windowMs: 15 * 60 * 1000,\n  max: 10,  \u002F\u002F 10 attempts per 15 minutes\n}));\n```\n\n## Secrets Management\n\n```\n.env files:\n  ├── .env.example  → Committed (template with placeholder values)\n  ├── .env          → NOT committed (contains real secrets)\n  └── .env.local    → NOT committed (local overrides)\n\n.gitignore must include:\n  .env\n  .env.local\n  .env.*.local\n  *.pem\n  *.key\n```\n\n**Always check before committing:**\n```bash\n# Check for accidentally staged secrets\ngit diff --cached | grep -i \"password\\|secret\\|api_key\\|token\"\n```\n\n## Security Review Checklist\n\n```markdown\n### Authentication\n- [ ] Passwords hashed with bcrypt\u002Fscrypt\u002Fargon2 (salt rounds ≥ 12)\n- [ ] Session tokens are httpOnly, secure, sameSite\n- [ ] Login has rate limiting\n- [ ] Password reset tokens expire\n\n### Authorization\n- [ ] Every endpoint checks user permissions\n- [ ] Users can only access their own resources\n- [ ] Admin actions require admin role verification\n\n### Input\n- [ ] All user input validated at the boundary\n- [ ] SQL queries are parameterized\n- [ ] HTML output is encoded\u002Fescaped\n\n### Data\n- [ ] No secrets in code or version control\n- [ ] Sensitive fields excluded from API responses\n- [ ] PII encrypted at rest (if applicable)\n\n### Infrastructure\n- [ ] Security headers configured (CSP, HSTS, etc.)\n- [ ] CORS restricted to known origins\n- [ ] Dependencies audited for vulnerabilities\n- [ ] Error messages don't expose internals\n```\n## See Also\n\nFor detailed security checklists and pre-commit verification steps, see `references\u002Fsecurity-checklist.md`.\n\n## Common Rationalizations\n\n| Rationalization | Reality |\n|---|---|\n| \"This is an internal tool, security doesn't matter\" | Internal tools get compromised. Attackers target the weakest link. |\n| \"We'll add security later\" | Security retrofitting is 10x harder than building it in. Add it now. |\n| \"No one would try to exploit this\" | Automated scanners will find it. Security by obscurity is not security. |\n| \"The framework handles security\" | Frameworks provide tools, not guarantees. You still need to use them correctly. |\n| \"It's just a prototype\" | Prototypes become production. Security habits from day one. |\n\n## Red Flags\n\n- User input passed directly to database queries, shell commands, or HTML rendering\n- Secrets in source code or commit history\n- API endpoints without authentication or authorization checks\n- Missing CORS configuration or wildcard (`*`) origins\n- No rate limiting on authentication endpoints\n- Stack traces or internal errors exposed to users\n- Dependencies with known critical vulnerabilities\n\n## Verification\n\nAfter implementing security-relevant code:\n\n- [ ] `npm audit` shows no critical or high vulnerabilities\n- [ ] No secrets in source code or git history\n- [ ] All user input validated at system boundaries\n- [ ] Authentication and authorization checked on every protected endpoint\n- [ ] Security headers present in response (check with browser DevTools)\n- [ ] Error responses don't expose internal details\n- [ ] Rate limiting active on auth endpoints",{"name":5,"description":7},"master","2a22abcae4e5677b6e385b5a0e144c48baac4a94",".claude\u002Fskills\u002Fsecurity-and-hardening",7,"https:\u002F\u002Fgithub.com\u002FsampleXbro\u002Fagentsmesh","https:\u002F\u002Fsamplexbro.github.io\u002Fagentsmesh\u002F","https:\u002F\u002Fgithub.com\u002FsampleXbro","Senior Software Engineer · React · TypeScript · Next.js · Smart TV specialist (Tizen, webOS, Android TV)","2026-11-06 03:06:21",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add sampleXbro\u002Fagentsmesh --skill security-and-hardening",{"tool":65,"command":66},"bunx","bunx skills add sampleXbro\u002Fagentsmesh --skill security-and-hardening",{"tool":68,"command":69},"pnpm","pnpm dlx skills add sampleXbro\u002Fagentsmesh --skill security-and-hardening","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FsampleXbro\u002Fagentsmesh\u002Fblob\u002Fmaster\u002F.claude\u002Fskills\u002Fsecurity-and-hardening\u002FSKILL.md",true,[],[74,90,106,127,133,151],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":85,"publishedAt":45},"01M6J2GJ4NDEPJND2GAXN0VPRB","research","Research docs and summarize decisions","https:\u002F\u002Fgithub.com\u002FsampleXbro\u002Fagentsmesh\u002Fblob\u002Fmaster\u002Ftests\u002Fe2e\u002Ffixtures\u002Fwindsurf-project\u002F.windsurf\u002Fskills\u002Fresearch\u002FSKILL.md",[80],{"categoryNo":81,"categoryName":82,"taxonomyType":83,"taxonomyTypeDesc":84},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[76,86,87,88,89],"docs","summarize","decisions","research docs",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":99,"publishedAt":45},"01M6J2GF8WQVFP75AMJWV7YM50","debugging","Systematic debugging workflow for production failures and test regressions.","https:\u002F\u002Fgithub.com\u002FsampleXbro\u002Fagentsmesh\u002Fblob\u002Fmaster\u002Ftests\u002Fe2e\u002Ffixtures\u002Fwarp-project\u002F.warp\u002Fskills\u002Fdebugging\u002FSKILL.md",[96],{"categoryNo":97,"categoryName":98,"taxonomyType":83,"taxonomyTypeDesc":84},"01JBSEEDCAT000000000000023","Skill与智能体开发",[92,100,101,102,103,104,105],"systematic debugging","workflow","test","Production","systematic","for",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":117,"publishedAt":45},"01M6J2GAQRCM0KV565J63STPWB","api-generator","Generate REST API endpoints with validation and tests","https:\u002F\u002Fgithub.com\u002FsampleXbro\u002Fagentsmesh\u002Fblob\u002Fmaster\u002Ftests\u002Fe2e\u002Ffixtures\u002Ftrae-project\u002F.trae\u002Fskills\u002Fapi-generator\u002FSKILL.md",[112,115,116],{"categoryNo":113,"categoryName":114,"taxonomyType":83,"taxonomyTypeDesc":84},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":97,"categoryName":98,"taxonomyType":83,"taxonomyTypeDesc":84},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118,119,120,121,122,123,124,31,125,126],"api","api generator","generator","REST","endpoints","rest api","tests","validation","generate",{"skillNo":128,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":45},"01M6J2G7VF3A2EGK5YBR4BM9KS","https:\u002F\u002Fgithub.com\u002FsampleXbro\u002Fagentsmesh\u002Fblob\u002Fmaster\u002Ftests\u002Fe2e\u002Ffixtures\u002Frovodev-project\u002F.rovodev\u002Fskills\u002Fdebugging\u002FSKILL.md",[131],{"categoryNo":97,"categoryName":98,"taxonomyType":83,"taxonomyTypeDesc":84},[92,105,101,102,100,103,104],{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":45},"01M6J2G4VHBHSPXGVQRZCH8CDW","typescript-pro","Apply advanced TypeScript patterns including conditional types, template literal types, and mapped types","https:\u002F\u002Fgithub.com\u002FsampleXbro\u002Fagentsmesh\u002Fblob\u002Fmaster\u002Ftests\u002Fe2e\u002Ffixtures\u002Froo-code-project\u002F.roo\u002Fskills\u002Ftypescript-pro\u002FSKILL.md",[139],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,142,143,144,41,145,146,147,148,149,150],"typescript","typescript pro","pro","patterns","architect","template","typescript patterns","Literal","types","advanced",{"skillNo":152,"name":92,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":45},"01M6J2G2133FJ5SAHK9WX4YVNV","Systematic debugging workflow for Replit projects","https:\u002F\u002Fgithub.com\u002FsampleXbro\u002Fagentsmesh\u002Fblob\u002Fmaster\u002Ftests\u002Fe2e\u002Ffixtures\u002Freplit-agent-project\u002F.agents\u002Fskills\u002Fdebugging\u002FSKILL.md",[156],{"categoryNo":97,"categoryName":98,"taxonomyType":83,"taxonomyTypeDesc":84},[92,100,158,104,105,101],"projects"]