skills.rest
AdelysAlberto
AdelysAlbertoCOMMUNITY
Explore all skills by this author →
Website𝕏@adelysalbertoGitHub

security-hardening

Applies OWASP Top 10 mitigations, rate limiting, and secure token handling to web APIs.

1|Updated Jul 18, 2025
Search Tags:#security#authentication#rate limiting#xss#owasp#csrf#api protection
One-click install
npx skills add https://github.com/AdelysAlberto/md-configs-and-agents --skill security-hardening-adelysalberto
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-hardening
Source: https://github.com/AdelysAlberto/md-configs-and-agents/tree/main/agents-opencode/skills/security-hardening
Command: npx skills add https://github.com/AdelysAlberto/md-configs-and-agents --skill security-hardening-adelysalberto

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications and APIs are frequently exposed to common attack vectors like SQL injection, XSS, CSRF, and broken object-level authorization. This Skill provides concrete, enforceable security standards so reviewers and developers can harden endpoints, protect credentials, and avoid leaking sensitive data. ## Core Features & Use Cases - OWASP Top 10 Mitigations: Enforces parameterized queries, DOMPurify sanitization, CSRF tokens, tenant-scoped queries, and secure HTTP headers via helmet. - Endpoint Rate Limiting: Applies strict rate limits to sensitive routes such as login, registration, password resets, and payment webhooks using Fastify or Express. - Token & Session Hygiene: Mandates HttpOnly Secure cookies, short-lived access tokens, refresh token rotation, and Redis-backed session revocation. - Use Case: When reviewing an authentication endpoint, use this Skill to verify rate limiting is configured, cookies are marked Secure and SameSite, and no JWTs are stored in localStorage. ## Quick Start Review my login and registration API endpoints for security vulnerabilities and apply rate limiting plus secure cookie settings.

Frequently Asked Questions about security-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add rate limiting to Fastify login endpoints?▼

Register @fastify/rate-limit with global set to false, then configure per-route limits such as max 5 requests per minute on the login route. Provide a custom errorResponseBuilder to return a structured RATE_LIMIT_EXCEEDED error response.

How to prevent SQL injection in Node.js APIs?▼

Use parameterized queries exclusively through an ORM like Drizzle or Prisma, or prepared statements. Never concatenate or format user input strings directly into SQL queries.

Should JWT access tokens be stored in localStorage?▼

No, never store JWTs or sensitive tokens in localStorage or unencrypted client stores. Keep short-lived access tokens in volatile memory and store refresh tokens in HttpOnly, Secure, SameSite cookies.

What HTTP security headers should an API set?▼

Set Content-Security-Policy, X-Frame-Options: DENY, and X-Content-Type-Options: nosniff using the helmet library. These headers mitigate clickjacking, MIME sniffing, and cross-site scripting attacks.

How do I prevent broken object level authorization (BOLA)?▼

Verify ownership and tenant scope on every query by scoping lookups with both the resource ID and the current tenant, such as WHERE id = :id AND tenant_id = :currentTenant. Never trust user-supplied IDs from URLs alone.

Related Skills

Explore More Software Engineering Skills→
CleanExpoCleanExpo
3

api-testing

Validate Next.js App Router API endpoints against Zod schemas and security checks.

Community
Advanced
JayRHaJayRHa
3

nginx-config-pro

Generate nginx reverse-proxy configurations with TLS, caching, and security headers.

Community
Advanced
j7-devj7-dev
19

springboot-verification

Automate build, static analysis, tests, security scans, and diff review for Spring Boot projects.

Community
Advanced
mfcollins3mfcollins3

azure-web-application-firewall

Configure and tune Azure WAF policies across Front Door and Application Gateway.

Community
Advanced