What problem does it solve? Backend services often ship with preventable vulnerabilities like SQL injection, broken access control, and leaked secrets because security guidance is scattered and applied inconsistently. This Skill consolidates authentication, authorization, secrets management, input validation, security headers, STRIDE threat modeling, and dependency scanning into one actionable reference for Python, TypeScript, and Go. ## Core Features & Use Cases - OWASP Top 10 Coverage: Quick-reference table plus deep dives on injection, broken access control (IDOR), and security misconfiguration with bad/good code examples in three languages. - Authentication & Authorization Patterns: Password hashing with bcrypt/argon2id, JWT signing and verification (RS256/HS256), refresh token rotation, OAuth2/OIDC flow selection with PKCE, RBAC vs ABAC, and resource-level ownership checks. - Secrets, Headers & Threat Modeling: Environment-based secrets progression from .env to Vault, security header baselines (CSP, HSTS, X-Frame-Options), CORS allowlisting, and a lightweight STRIDE threat modeling process. - Use Case: Before launching a new invoicing API, run a STRIDE threat model on each data flow, implement ownership checks on every handler, configure security headers via middleware, and wire pip-audit/npm audit/govulncheck into CI to fail builds on HIGH severity CVEs. ## Quick Start Ask the AI to audit your API endpoint code against the OWASP Top 10 checklist and fix any injection, access control, or secrets management issues it finds.
