skills.rest
joaoguirunas
joaoguirunasCOMMUNITY
Explore all skills by this author →
GitHub

dev-security-patterns

Implements authentication, authorization, RLS, input validation, and OWASP mitigations for web applications.

3|3|Updated Apr 23, 2026
Search Tags:#security#authentication#input validation#jwt#owasp#rbac#row level security
One-click install
npx skills add https://github.com/joaoguirunas/team-os --skill dev-security-patterns-joaoguirunas
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dev-security-patterns
Source: https://github.com/joaoguirunas/team-os/tree/main/.claude/skills/dev-security-patterns
Command: npx skills add https://github.com/joaoguirunas/team-os --skill dev-security-patterns-joaoguirunas

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Building secure software requires consistent application of authentication, authorization, input validation, and secrets management patterns, and missing any one of them exposes applications to the OWASP Top 10 risks. ## Core Features & Use Cases - JWT Authentication & RBAC: Provides TypeScript patterns for short-lived access tokens, refresh token rotation, httpOnly cookies, and role-based route guards. - Row Level Security & Input Validation: Includes Supabase/Postgres RLS policy examples and Zod-based schema validation middleware that sanitizes all client input. - OWASP Top 10 Checklist & Secrets Management: Maps each major risk to a concrete mitigation, plus rules for environment variables, rate limiting, bcrypt password hashing, and structured logging with requestId. - Use Case: When building a new API endpoint that handles user data, apply these patterns to add JWT verification, role checks, RLS policies, Zod validation, and rate limiting before shipping. ## Quick Start Ask the agent to review your authentication and API endpoints using the dev-security-patterns skill and apply the JWT, RBAC, RLS, and validation patterns where missing.

Frequently Asked Questions about dev-security-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication in Express with TypeScript?▼

Sign a short-lived access token (15 minutes) and a 7-day refresh token with separate secrets, then verify the Bearer token in middleware and attach the decoded user to the request. Store tokens in httpOnly cookies, never localStorage, and use secrets of at least 256 bits.

How to set up Row Level Security in Supabase or Postgres?▼

Enable RLS on the table with ALTER TABLE ... ENABLE ROW LEVEL SECURITY, then create policies such as auth.uid() = user_id so users only see their own rows. Add a separate admin policy checking the JWT role claim, and apply RLS to every table containing user data.

What is the best way to validate API request input in Node.js?▼

Use Zod schemas with a validate middleware that runs safeParse on the request body and returns a 400 VALIDATION_ERROR with details and requestId on failure. Replace req.body with the sanitized parsed data so downstream handlers never touch raw client input.

Does bcrypt cost factor 12 work for password hashing?▼

Yes, bcrypt with a cost factor of 12 is the recommended minimum for hashing passwords before storage. Never use MD5, SHA1, or plain text for passwords, and always verify with bcrypt.compare rather than re-hashing manually.

Why should I never store JWT tokens in localStorage?▼

localStorage is accessible to any JavaScript running on the page, so an XSS vulnerability can steal the token. httpOnly cookies block script access to the token, which is the storage approach these patterns require.

What should never appear in application logs?▼

Never log passwords, JWT tokens, credit card data, CPF/SSN, or unnecessary PII. Always log the requestId, userId (not email), action, success or failure result, and IP address for authentication events.

Related Skills

Explore More Software Engineering Skills→
DexploarerDexploarer
6

express-api-generator

Generate Express.js REST APIs with TypeScript, validation, and error handling.

Community
Advanced
nksethnkseth

security-reviewer

Identify security vulnerabilities in code and infrastructure and deliver prioritized audit reports with remediation guidance.

Community
Advanced
h4vzzh4vzz
33

cloud-monitoring

Monitor cloud infrastructure with metrics, logs, traces, and alerting.

Community
Advanced
Sumeet138Sumeet138
1

auth-implementation-patterns

Implement JWT, OAuth2, and RBAC authentication for web services.

Community
Advanced