What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, broken access control, and secret leakage. This Skill provides a structured security-first workflow so every line of code touching user data, authentication, or external systems follows hardened practices instead of ad-hoc fixes. ## Core Features & Use Cases - Three-Tier Boundary System: Clear rules for what to always do (parameterized queries, output encoding, security headers), what requires human approval (new auth flows, CORS changes, file uploads), and what to never do (commit secrets, log sensitive data, use eval with user input). - OWASP Top 10 Prevention Patterns: Ready-to-use TypeScript examples for SQL injection prevention, bcrypt password hashing, session cookie configuration, DOMPurify sanitization, authorization checks, helmet/CSP headers, and Zod schema validation. - Operational Guidance: npm audit triage decision tree, rate limiting setup, secrets management with .env conventions, and a full security review checklist. - Use Case: When adding a new API endpoint that accepts user input and stores data, apply the Skill to validate input with Zod at the boundary, parameterize database queries, enforce per-user authorization, and verify no secrets or stack traces leak in responses. ## Quick Start Use the security-and-hardening skill to review my new authentication endpoint and check it against the OWASP prevention checklist.
