skills.rest
insightriot
insightriotOFFICIAL
Explore all skills by this author →
GitHub

security-and-hardening

Applies security-first coding practices covering OWASP prevention, input validation, and secrets management.

1|Updated Apr 13, 2026
Search Tags:#security#authentication#input validation#owasp#npm audit#express#hardening
One-click install
npx skills add https://github.com/insightriot/signal --skill security-and-hardening-insightriot
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/insightriot/signal/tree/main/plugin/skills/review/security-and-hardening
Command: npx skills add https://github.com/insightriot/signal --skill security-and-hardening-insightriot

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications that accept user input, handle authentication, or store sensitive data are exposed to injection, XSS, broken access control, and leaked secrets. This Skill embeds security constraints into every line of code that touches user data, authentication, or external systems, instead of treating security as an afterthought. ## Core Features & Use Cases - Three-Tier Boundary System: Defines what to always do (parameterized queries, output encoding, HTTPS, hashed passwords), what requires human approval (new auth flows, CORS changes, file uploads), and what to never do (commit secrets, log sensitive data, trust client-side validation). - OWASP Top 10 Prevention: Provides concrete TypeScript/Express code patterns for injection, broken authentication, XSS, broken access control, security misconfiguration, and sensitive data exposure. - Operational Guidance: Includes npm audit triage decision trees, rate limiting setup, secrets management with .env hygiene, and a full security review checklist. - Use Case: When adding a file upload endpoint to an Express API, use this Skill to enforce MIME type and size validation, apply rate limiting, set security headers via helmet, and verify no secrets leak into version control. ## Quick Start Review my new Express API endpoint for security issues and apply the hardening checklist before I commit it.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE id = $1', [userId]), or by using an ORM like Prisma that parameterizes inputs automatically. Never interpolate user input directly into query strings.

How do I validate user input in Express APIs?▼

Validate all input at the route boundary using a schema library like zod. Define a schema with constraints on types, lengths, and enums, call safeParse on the request body, and return a 422 validation error response when parsing fails before touching business logic.

How should I triage npm audit vulnerabilities?▼

Triage npm audit results by severity and reachability: fix critical or high vulnerabilities immediately if the vulnerable code path is reachable, schedule moderate issues for the next release, and track low-severity items for routine updates. Document a reason and review date when deferring any fix.

What security headers should an Express app set?▼

An Express app should set CSP, HSTS, X-Frame-Options, and X-Content-Type-Options headers, typically via the helmet middleware. Configure a restrictive Content Security Policy and limit CORS to known origins rather than using wildcard origins.

Why is storing auth tokens in localStorage insecure?▼

Storing auth tokens in localStorage exposes them to any JavaScript running on the page, making them stealable via XSS attacks. Use httpOnly, secure, sameSite cookies for sessions instead so tokens are never accessible to client-side scripts.

When does security review require human approval?▼

Human approval is required before adding new authentication flows, storing new categories of sensitive data like PII or payment info, changing CORS configuration, adding file upload handlers, modifying rate limiting, or granting elevated permissions or roles.

Related Skills

Explore More Software Engineering Skills→
logo-solutionslogo-solutions

security-and-hardening

Harden web applications against security vulnerabilities in input handling, authentication, and data storage.

Official
Advanced
dreamingechoesdreamingechoes
2

security-audit

Audit codebases for dependency, authentication, and configuration vulnerabilities.

Community
Advanced
ArabelaTsoArabelaTso
142

security-sensitive-path-instrumenter

Add structured logging to authentication, authorization, and input-handling code paths.

Community
Intermediate
ColdBoxColdBox

coldbox-security-implementation

Configure CBSecurity authentication, authorization, and firewall rules for ColdBox apps.

Official
Advanced