[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EQDQZ19SCAPV75P36P9S7":3,"skill-same:01M71EQDQZ19SCAPV75P36P9S7":62},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":43,"repositoryHtmlUrl":44,"repositoryHomepageUrl":6,"ownerHtmlUrl":45,"ownerBlogUrl":6,"ownerDescription":46,"updatedAt":47,"install":48,"resources":61},"01M71EQDQZ19SCAPV75P36P9S7","laravel-security",null,"Laravel security best practices for authn\u002Fauthz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.","ViewWay\u002Fhermes-by-everythings","ViewWay","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F57283862?v=4","01M71ENR60K309MXA64A23SEW5","01M71ENR6QYM7NQHP29W53HSXT",3,"MIT","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Flaravel-security\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"laravel security","laravel","security","csrf","secrets","secure","rate","security best practices","file uploads","for","deployment","best practices","file","uploads","rate limiting","validation","2026-11-10 10:12:30",false,"---\nname: laravel-security\ndescription: Laravel security best practices for authn\u002Fauthz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.\norigin: ECC\n---\n\n# Laravel Security Best Practices\n\nComprehensive security guidance for Laravel applications to protect against common vulnerabilities.\n\n## When to Activate\n\n- Adding authentication or authorization\n- Handling user input and file uploads\n- Building new API endpoints\n- Managing secrets and environment settings\n- Hardening production deployments\n\n## How It Works\n\n- Middleware provides baseline protections (CSRF via `VerifyCsrfToken`, security headers via `SecurityHeaders`).\n- Guards and policies enforce access control (`auth:sanctum`, `$this->authorize`, policy middleware).\n- Form Requests validate and shape input (`UploadInvoiceRequest`) before it reaches services.\n- Rate limiting adds abuse protection (`RateLimiter::for('login')`) alongside auth controls.\n- Data safety comes from encrypted casts, mass-assignment guards, and signed routes (`URL::temporarySignedRoute` + `signed` middleware).\n\n## Core Security Settings\n\n- `APP_DEBUG=false` in production\n- `APP_KEY` must be set and rotated on compromise\n- Set `SESSION_SECURE_COOKIE=true` and `SESSION_SAME_SITE=lax` (or `strict` for sensitive apps)\n- Configure trusted proxies for correct HTTPS detection\n\n## Session and Cookie Hardening\n\n- Set `SESSION_HTTP_ONLY=true` to prevent JavaScript access\n- Use `SESSION_SAME_SITE=strict` for high-risk flows\n- Regenerate sessions on login and privilege changes\n\n## Authentication and Tokens\n\n- Use Laravel Sanctum or Passport for API auth\n- Prefer short-lived tokens with refresh flows for sensitive data\n- Revoke tokens on logout and compromised accounts\n\nExample route protection:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::middleware('auth:sanctum')->get('\u002Fme', function (Request $request) {\n    return $request->user();\n});\n```\n\n## Password Security\n\n- Hash passwords with `Hash::make()` and never store plaintext\n- Use Laravel's password broker for reset flows\n\n```php\nuse Illuminate\\Support\\Facades\\Hash;\nuse Illuminate\\Validation\\Rules\\Password;\n\n$validated = $request->validate([\n    'password' => ['required', 'string', Password::min(12)->letters()->mixedCase()->numbers()->symbols()],\n]);\n\n$user->update(['password' => Hash::make($validated['password'])]);\n```\n\n## Authorization: Policies and Gates\n\n- Use policies for model-level authorization\n- Enforce authorization in controllers and services\n\n```php\n$this->authorize('update', $project);\n```\n\nUse policy middleware for route-level enforcement:\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::put('\u002Fprojects\u002F{project}', [ProjectController::class, 'update'])\n    ->middleware(['auth:sanctum', 'can:update,project']);\n```\n\n## Validation and Data Sanitization\n\n- Always validate inputs with Form Requests\n- Use strict validation rules and type checks\n- Never trust request payloads for derived fields\n\n## Mass Assignment Protection\n\n- Use `$fillable` or `$guarded` and avoid `Model::unguard()`\n- Prefer DTOs or explicit attribute mapping\n\n## SQL Injection Prevention\n\n- Use Eloquent or query builder parameter binding\n- Avoid raw SQL unless strictly necessary\n\n```php\nDB::select('select * from users where email = ?', [$email]);\n```\n\n## XSS Prevention\n\n- Blade escapes output by default (`{{ }}`)\n- Use `{!! !!}` only for trusted, sanitized HTML\n- Sanitize rich text with a dedicated library\n\n## CSRF Protection\n\n- Keep `VerifyCsrfToken` middleware enabled\n- Include `@csrf` in forms and send XSRF tokens for SPA requests\n\nFor SPA authentication with Sanctum, ensure stateful requests are configured:\n\n```php\n\u002F\u002F config\u002Fsanctum.php\n'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost')),\n```\n\n## File Upload Safety\n\n- Validate file size, MIME type, and extension\n- Store uploads outside the public path when possible\n- Scan files for malware if required\n\n```php\nfinal class UploadInvoiceRequest extends FormRequest\n{\n    public function authorize(): bool\n    {\n        return (bool) $this->user()?->can('upload-invoice');\n    }\n\n    public function rules(): array\n    {\n        return [\n            'invoice' => ['required', 'file', 'mimes:pdf', 'max:5120'],\n        ];\n    }\n}\n```\n\n```php\n$path = $request->file('invoice')->store(\n    'invoices',\n    config('filesystems.private_disk', 'local') \u002F\u002F set this to a non-public disk\n);\n```\n\n## Rate Limiting\n\n- Apply `throttle` middleware on auth and write endpoints\n- Use stricter limits for login, password reset, and OTP\n\n```php\nuse Illuminate\\Cache\\RateLimiting\\Limit;\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\RateLimiter;\n\nRateLimiter::for('login', function (Request $request) {\n    return [\n        Limit::perMinute(5)->by($request->ip()),\n        Limit::perMinute(5)->by(strtolower((string) $request->input('email'))),\n    ];\n});\n```\n\n## Secrets and Credentials\n\n- Never commit secrets to source control\n- Use environment variables and secret managers\n- Rotate keys after exposure and invalidate sessions\n\n## Encrypted Attributes\n\nUse encrypted casts for sensitive columns at rest.\n\n```php\nprotected $casts = [\n    'api_token' => 'encrypted',\n];\n```\n\n## Security Headers\n\n- Add CSP, HSTS, and frame protection where appropriate\n- Use trusted proxy configuration to enforce HTTPS redirects\n\nExample middleware to set headers:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Symfony\\Component\\HttpFoundation\\Response;\n\nfinal class SecurityHeaders\n{\n    public function handle(Request $request, \\Closure $next): Response\n    {\n        $response = $next($request);\n\n        $response->headers->add([\n            'Content-Security-Policy' => \"default-src 'self'\",\n            'Strict-Transport-Security' => 'max-age=31536000', \u002F\u002F add includeSubDomains\u002Fpreload only when all subdomains are HTTPS\n            'X-Frame-Options' => 'DENY',\n            'X-Content-Type-Options' => 'nosniff',\n            'Referrer-Policy' => 'no-referrer',\n        ]);\n\n        return $response;\n    }\n}\n```\n\n## CORS and API Exposure\n\n- Restrict origins in `config\u002Fcors.php`\n- Avoid wildcard origins for authenticated routes\n\n```php\n\u002F\u002F config\u002Fcors.php\nreturn [\n    'paths' => ['api\u002F*', 'sanctum\u002Fcsrf-cookie'],\n    'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n    'allowed_origins' => ['https:\u002F\u002Fapp.example.com'],\n    'allowed_headers' => [\n        'Content-Type',\n        'Authorization',\n        'X-Requested-With',\n        'X-XSRF-TOKEN',\n        'X-CSRF-TOKEN',\n    ],\n    'supports_credentials' => true,\n];\n```\n\n## Logging and PII\n\n- Never log passwords, tokens, or full card data\n- Redact sensitive fields in structured logs\n\n```php\nuse Illuminate\\Support\\Facades\\Log;\n\nLog::info('User updated profile', [\n    'user_id' => $user->id,\n    'email' => '[REDACTED]',\n    'token' => '[REDACTED]',\n]);\n```\n\n## Dependency Security\n\n- Run `composer audit` regularly\n- Pin dependencies with care and update promptly on CVEs\n\n## Signed URLs\n\nUse signed routes for temporary, tamper-proof links.\n\n```php\nuse Illuminate\\Support\\Facades\\URL;\n\n$url = URL::temporarySignedRoute(\n    'downloads.invoice',\n    now()->addMinutes(15),\n    ['invoice' => $invoice->id]\n);\n```\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::get('\u002Finvoices\u002F{invoice}\u002Fdownload', [InvoiceController::class, 'download'])\n    ->name('downloads.invoice')\n    ->middleware('signed');\n```\n","# Laravel Security Best Practices\n\nComprehensive security guidance for Laravel applications to protect against common vulnerabilities.\n\n## When to Activate\n\n- Adding authentication or authorization\n- Handling user input and file uploads\n- Building new API endpoints\n- Managing secrets and environment settings\n- Hardening production deployments\n\n## How It Works\n\n- Middleware provides baseline protections (CSRF via `VerifyCsrfToken`, security headers via `SecurityHeaders`).\n- Guards and policies enforce access control (`auth:sanctum`, `$this->authorize`, policy middleware).\n- Form Requests validate and shape input (`UploadInvoiceRequest`) before it reaches services.\n- Rate limiting adds abuse protection (`RateLimiter::for('login')`) alongside auth controls.\n- Data safety comes from encrypted casts, mass-assignment guards, and signed routes (`URL::temporarySignedRoute` + `signed` middleware).\n\n## Core Security Settings\n\n- `APP_DEBUG=false` in production\n- `APP_KEY` must be set and rotated on compromise\n- Set `SESSION_SECURE_COOKIE=true` and `SESSION_SAME_SITE=lax` (or `strict` for sensitive apps)\n- Configure trusted proxies for correct HTTPS detection\n\n## Session and Cookie Hardening\n\n- Set `SESSION_HTTP_ONLY=true` to prevent JavaScript access\n- Use `SESSION_SAME_SITE=strict` for high-risk flows\n- Regenerate sessions on login and privilege changes\n\n## Authentication and Tokens\n\n- Use Laravel Sanctum or Passport for API auth\n- Prefer short-lived tokens with refresh flows for sensitive data\n- Revoke tokens on logout and compromised accounts\n\nExample route protection:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::middleware('auth:sanctum')->get('\u002Fme', function (Request $request) {\n    return $request->user();\n});\n```\n\n## Password Security\n\n- Hash passwords with `Hash::make()` and never store plaintext\n- Use Laravel's password broker for reset flows\n\n```php\nuse Illuminate\\Support\\Facades\\Hash;\nuse Illuminate\\Validation\\Rules\\Password;\n\n$validated = $request->validate([\n    'password' => ['required', 'string', Password::min(12)->letters()->mixedCase()->numbers()->symbols()],\n]);\n\n$user->update(['password' => Hash::make($validated['password'])]);\n```\n\n## Authorization: Policies and Gates\n\n- Use policies for model-level authorization\n- Enforce authorization in controllers and services\n\n```php\n$this->authorize('update', $project);\n```\n\nUse policy middleware for route-level enforcement:\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::put('\u002Fprojects\u002F{project}', [ProjectController::class, 'update'])\n    ->middleware(['auth:sanctum', 'can:update,project']);\n```\n\n## Validation and Data Sanitization\n\n- Always validate inputs with Form Requests\n- Use strict validation rules and type checks\n- Never trust request payloads for derived fields\n\n## Mass Assignment Protection\n\n- Use `$fillable` or `$guarded` and avoid `Model::unguard()`\n- Prefer DTOs or explicit attribute mapping\n\n## SQL Injection Prevention\n\n- Use Eloquent or query builder parameter binding\n- Avoid raw SQL unless strictly necessary\n\n```php\nDB::select('select * from users where email = ?', [$email]);\n```\n\n## XSS Prevention\n\n- Blade escapes output by default (`{{ }}`)\n- Use `{!! !!}` only for trusted, sanitized HTML\n- Sanitize rich text with a dedicated library\n\n## CSRF Protection\n\n- Keep `VerifyCsrfToken` middleware enabled\n- Include `@csrf` in forms and send XSRF tokens for SPA requests\n\nFor SPA authentication with Sanctum, ensure stateful requests are configured:\n\n```php\n\u002F\u002F config\u002Fsanctum.php\n'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost')),\n```\n\n## File Upload Safety\n\n- Validate file size, MIME type, and extension\n- Store uploads outside the public path when possible\n- Scan files for malware if required\n\n```php\nfinal class UploadInvoiceRequest extends FormRequest\n{\n    public function authorize(): bool\n    {\n        return (bool) $this->user()?->can('upload-invoice');\n    }\n\n    public function rules(): array\n    {\n        return [\n            'invoice' => ['required', 'file', 'mimes:pdf', 'max:5120'],\n        ];\n    }\n}\n```\n\n```php\n$path = $request->file('invoice')->store(\n    'invoices',\n    config('filesystems.private_disk', 'local') \u002F\u002F set this to a non-public disk\n);\n```\n\n## Rate Limiting\n\n- Apply `throttle` middleware on auth and write endpoints\n- Use stricter limits for login, password reset, and OTP\n\n```php\nuse Illuminate\\Cache\\RateLimiting\\Limit;\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\RateLimiter;\n\nRateLimiter::for('login', function (Request $request) {\n    return [\n        Limit::perMinute(5)->by($request->ip()),\n        Limit::perMinute(5)->by(strtolower((string) $request->input('email'))),\n    ];\n});\n```\n\n## Secrets and Credentials\n\n- Never commit secrets to source control\n- Use environment variables and secret managers\n- Rotate keys after exposure and invalidate sessions\n\n## Encrypted Attributes\n\nUse encrypted casts for sensitive columns at rest.\n\n```php\nprotected $casts = [\n    'api_token' => 'encrypted',\n];\n```\n\n## Security Headers\n\n- Add CSP, HSTS, and frame protection where appropriate\n- Use trusted proxy configuration to enforce HTTPS redirects\n\nExample middleware to set headers:\n\n```php\nuse Illuminate\\Http\\Request;\nuse Symfony\\Component\\HttpFoundation\\Response;\n\nfinal class SecurityHeaders\n{\n    public function handle(Request $request, \\Closure $next): Response\n    {\n        $response = $next($request);\n\n        $response->headers->add([\n            'Content-Security-Policy' => \"default-src 'self'\",\n            'Strict-Transport-Security' => 'max-age=31536000', \u002F\u002F add includeSubDomains\u002Fpreload only when all subdomains are HTTPS\n            'X-Frame-Options' => 'DENY',\n            'X-Content-Type-Options' => 'nosniff',\n            'Referrer-Policy' => 'no-referrer',\n        ]);\n\n        return $response;\n    }\n}\n```\n\n## CORS and API Exposure\n\n- Restrict origins in `config\u002Fcors.php`\n- Avoid wildcard origins for authenticated routes\n\n```php\n\u002F\u002F config\u002Fcors.php\nreturn [\n    'paths' => ['api\u002F*', 'sanctum\u002Fcsrf-cookie'],\n    'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n    'allowed_origins' => ['https:\u002F\u002Fapp.example.com'],\n    'allowed_headers' => [\n        'Content-Type',\n        'Authorization',\n        'X-Requested-With',\n        'X-XSRF-TOKEN',\n        'X-CSRF-TOKEN',\n    ],\n    'supports_credentials' => true,\n];\n```\n\n## Logging and PII\n\n- Never log passwords, tokens, or full card data\n- Redact sensitive fields in structured logs\n\n```php\nuse Illuminate\\Support\\Facades\\Log;\n\nLog::info('User updated profile', [\n    'user_id' => $user->id,\n    'email' => '[REDACTED]',\n    'token' => '[REDACTED]',\n]);\n```\n\n## Dependency Security\n\n- Run `composer audit` regularly\n- Pin dependencies with care and update promptly on CVEs\n\n## Signed URLs\n\nUse signed routes for temporary, tamper-proof links.\n\n```php\nuse Illuminate\\Support\\Facades\\URL;\n\n$url = URL::temporarySignedRoute(\n    'downloads.invoice',\n    now()->addMinutes(15),\n    ['invoice' => $invoice->id]\n);\n```\n\n```php\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::get('\u002Finvoices\u002F{invoice}\u002Fdownload', [InvoiceController::class, 'download'])\n    ->name('downloads.invoice')\n    ->middleware('signed');\n```\n",{"name":5,"origin":39,"description":7},"ECC","main","0446e11613ad1942de249b12f7deea3889c25af4","skills\u002Flaravel-security",0,"https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings","https:\u002F\u002Fgithub.com\u002FViewWay","rust can do everything","2026-06-19 23:27:05",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add ViewWay\u002Fhermes-by-everythings --skill laravel-security",{"tool":54,"command":55},"bunx","bunx skills add ViewWay\u002Fhermes-by-everythings --skill laravel-security",{"tool":57,"command":58},"pnpm","pnpm dlx skills add ViewWay\u002Fhermes-by-everythings --skill laravel-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Flaravel-security\u002FSKILL.md",true,[],[63,103,129,155,183,204],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":82,"publishedAt":34},"01M71EREGWXCCGBGDZ969RZQA7","ui-ux-pro-max","UI\u002FUX design intelligence and implementation guidance for building polished interfaces. Use when the user asks for UI design, UX flows, information architecture, visual style direction, design systems\u002Ftokens, component specs, copy\u002Fmicrocopy, accessibility, or to generate\u002Fcritique\u002Frefine frontend UI (HTML\u002FCSS\u002FJS, React, Next.js, Vue, Svelte, Tailwind). Includes workflows for (1) generating new UI layouts and styling, (2) improving existing UI\u002FUX, (3) producing design-system tokens and component guidelines, and (4) turning UX recommendations into concrete code changes.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fui-ux-pro-max\u002FSKILL.md",[69,74,77],{"categoryNo":70,"categoryName":71,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":75,"categoryName":76,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102],"ux","max","ui ux","ui","ui ux pro max","pro","information architecture","css","microcopy","direction","Tailwind","flows","frontend","design","new","svelte","design systems","information","workflows","when",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":34},"01M71ERBY797MAY4HTFMSHPXMY","springboot-verification","Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fspringboot-verification\u002FSKILL.md",[],[110,111,112,113,114,115,116,27,117,118,119,120,121,122,123,124,125,126,127,128],"springboot verification","verification","coverage","projects","verification loop","pr","diff","static","tests","spring boot","diff review","spring","loop","boot","analysis","review","with","build","release",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":138,"publishedAt":34},"01M71ER9TQGK9Y00JEEM6RW9RY","springboot-patterns","Spring Boot architecture patterns, REST API design, layered services, data access, caching, async processing, and logging. Use for Java Spring Boot backend work.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fspringboot-patterns\u002FSKILL.md",[135],{"categoryNo":136,"categoryName":137,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000010","后端与接口",[139,140,141,142,119,96,143,144,145,146,147,148,149,150,151,27,152,153,154,121],"patterns","springboot patterns","processing","rest api design","access","caching","architecture","api","spring boot architecture","work","data","architecture patterns","logging","async","java spring","use",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":168,"publishedAt":34},"01M71ER6XTWDJ0NVE5RFY28RE7","security-auditor","Use when reviewing code for security vulnerabilities, implementing authentication flows, auditing OWASP Top 10, configuring CORS\u002FCSP headers, handling secrets, input validation, SQL injection prevention, XSS protection, or any security-related code review.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-auditor\u002FSKILL.md",[161,164,165],{"categoryNo":162,"categoryName":163,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":136,"categoryName":137,"taxonomyType":72,"taxonomyTypeDesc":73},{"categoryNo":166,"categoryName":167,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000033","数据分析师",[20,169,170,171,172,94,173,21,174,102,175,176,177,178,125,179,180,181,182,22],"security auditor","auditor","authentication","code review","implementing","Input Validation","encryption","code","vulnerability","xss","top","owasp top 10","audit","sql",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":192,"publishedAt":34},"01M71ER4PHRJ1EKXQTQPEPYQ6J","rust-testing","Rust testing patterns including unit tests, integration tests, async testing, property-based testing, mocking, and coverage. Follows TDD methodology.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Frust-testing\u002FSKILL.md",[189],{"categoryNo":190,"categoryName":191,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000008","测试与质量",[193,194,195,112,196,197,139,198,152,199,118,200,201,202,203],"rust","testing","rust testing","unit","testing patterns","integration tests","mocking","unit tests","tdd","integration","methodology",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":34},"01M71ER0XW3N4K7YTQSXXWW3M3","rust-patterns","Idiomatic Rust patterns, ownership, error handling, traits, concurrency, and best practices for building safe, performant applications.","https:\u002F\u002Fgithub.com\u002FViewWay\u002Fhermes-by-everythings\u002Fblob\u002Fmain\u002Fskills\u002Frust-patterns\u002FSKILL.md",[],[193,139,211,212,213,214,215,216,27,217,29,218,219],"rust patterns","error","traits","concurrency","safe","idiomatic","applications","error handling","ownership"]