SECURITY-credentials

What problem does it solve?

Improper handling of passwords, API keys, and third-party credentials is a critical security vulnerability, leading to data breaches, compliance failures, and severe reputational damage. This Skill enforces CRITICAL security rules.

Core Features & Use Cases

• NEVER Store Passwords: Mandates storing password HASHES only, using bcrypt (cost 12+) or argon2id, never plaintext or reversible encryption.
• NEVER Accept Third-Party Credentials: Enforces using OAuth for external services (e.g., Google, PayPal), never asking users for their passwords to other platforms.
• Proper Cryptography: Guides on using established libraries for hashing (bcrypt/argon2) and encryption (Node.js crypto module), and storing API keys in environment variables.
• Anti-Pattern Flagging: Identifies and prohibits critical anti-patterns like Base64 "encryption" or weak hashing algorithms (MD5, SHA-1).
• Use Case: Implement a secure user registration process, ensuring passwords are hashed with bcrypt, API keys are loaded from environment variables, and any third-party integrations use OAuth, preventing critical security vulnerabilities.

Quick Start

Implement a hashPassword function using bcrypt with SALT_ROUNDS = 12 and a verifyPassword function to check against stored hashes.