advanced-backend-security-shield

Run a layered review covering proxy configuration, authentication, authorization, input validation, and data storage. This Skill inspects your actual workspace files, ties every finding to concrete evidence, and proposes minimal patches with verification steps.

Validate JWT algorithm allowlists, issuer, audience, expiry, and key rotation, and keep access tokens short-lived. For cookies, require HttpOnly, Secure, narrow Path, and the strictest compatible SameSite, rotating session identifiers after login or privilege changes.

Use parameterized queries or safe ORM APIs and never interpolate untrusted input into SQL. Prevent mass assignment by explicitly mapping mutable fields instead of binding request payloads directly to persistence models.

No, it is restricted to authorized defensive engineering only. It explicitly refuses exploit weaponization, credential theft, persistence, stealth, or attacks on systems without explicit authorization.

Enforce authentication, size and count limits, generated filenames, path isolation, and magic-byte plus parser validation rather than trusting extensions or MIME headers. Store uploads in non-executable private storage and serve downloads with safe content types.

Confirmed findings are directly demonstrated by code, configuration, or controlled tests, while likely findings have strong evidence without runtime verification. This separation prevents assumptions from being presented as vulnerabilities and clarifies residual risk.