skills.rest
Rkaaaa404
Rkaaaa404COMMUNITY
Explore all skills by this author →
GitHub

security-and-hardening

Hardens web application code against vulnerabilities through validation, authentication, and configuration checklists.

Updated May 27, 2026
Search Tags:#security#authentication#input validation#next.js#zod#cors#hardening
One-click install
npx skills add https://github.com/Rkaaaa404/cyberhack-SYDT --skill security-and-hardening-rkaaaa404
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/Rkaaaa404/cyberhack-SYDT/tree/main/.agents/skills/security-and-hardening
Command: npx skills add https://github.com/Rkaaaa404/cyberhack-SYDT --skill security-and-hardening-rkaaaa404

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires zod, and includes references (resource) components.

What problem does it solve? Web applications that accept user input, manage sessions, or integrate external services are exposed to injection, XSS, credential leaks, and misconfiguration risks. This Skill provides a structured security review framework so vulnerabilities are caught during development instead of after deployment. ## Core Features & Use Cases - Three-Tier Boundary System: Clear rules for what must always be done (input validation, parameterized queries, security headers), what requires human approval (new auth flows, CORS changes, file uploads), and what must never be done (committing secrets, using eval with user data). - DaaS/Supabase Proxy Patterns: Concrete guidance on routing browser requests through Next.js API routes, correct environment variable scoping, and safe CORS configuration with credentials. - Zod-Based Input Validation: Ready-to-adapt schema validation patterns for API route handlers with typed, validated output. - Use Case: Before shipping a new file upload endpoint, run the security review checklist to confirm authentication checks, rate limiting, input validation, and header configuration are all in place. ## Quick Start Review my new API route for security issues using the security and hardening checklist.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate user input in a Next.js API route?▼

Use Zod to define a schema for the request body, then call safeParse in the route handler. On failure, return a 422 response with the flattened error details; on success, the parsed data is typed and safe to use.

What security headers should a web application set?▼

Set Content-Security-Policy, HSTS, X-Frame-Options, and X-Content-Type-Options on all responses. Session cookies should use httpOnly, secure, and sameSite flags, and you can verify headers in browser DevTools.

How do I configure CORS with credentials in a DaaS backend?▼

List explicit allowed origins such as localhost and your deployed domain, set cors_allow_credentials to true, and never use a wildcard origin with credentials. Set cors_max_age to 0 while changing configuration to bust cached preflight responses.

Can I store auth tokens in localStorage?▼

No. Auth tokens in localStorage are accessible to any script running on the page, making them vulnerable to XSS theft. Use httpOnly, secure, sameSite cookies for sessions instead.

Why should browser requests go through API routes instead of calling Supabase directly?▼

Proxying through API routes avoids CORS issues and prevents exposure of service-role credentials. The browser calls /api/auth/login or /api/items endpoints, which then communicate with Supabase or the DaaS backend server-side.

What should I check before releasing security-relevant code?▼

Run pnpm audit to confirm no critical or high vulnerabilities, verify no secrets exist in source or git history, confirm input validation at all boundaries, and check that error responses do not expose internal details.

Related Skills

Explore More Software Engineering Skills→
Alif-NAlif-N

daas-platform

Automate data integration, processing, and synchronization in a DaaS platform.

Community
Advanced
kevindreekevindree

security-and-hardening

Harden web application code against OWASP security vulnerabilities and unsafe external input.

Community
Advanced
chicanoandres702chicanoandres702

error-diagnostics-error-analysis

Analyze distributed system errors to produce incident reports with remediation steps.

Community
Advanced
amo-tech-aiamo-tech-ai

security-hardening

Audit and harden application security across RLS policies, authentication, secrets, headers, and rate limiting.

Community
Advanced