What problem does it solve? Security flaws like SQL injection, hardcoded secrets, and misconfigured CORS often slip into production code unnoticed. This Skill provides structured OWASP Top 10 (2025) guidance plus an automated scanner that detects vulnerabilities, exposed credentials, and dangerous code patterns before they become incidents. ## Core Features & Use Cases - OWASP Top 10 Reference: Covers injection attacks, broken access control, cryptographic failures, SSRF, and supply chain risks with vulnerable vs. safe code examples. - Automated Security Scanning: The security_scan.py script checks dependencies (npm audit, lock files), scans for hardcoded secrets (AWS keys, JWTs, database strings), detects dangerous patterns (eval, innerHTML, SQL concatenation), and validates security configurations. - Audit Checklists: Ready-to-use checklists for authentication, API security, data protection, and security headers that can be copied into security reports. - Use Case: Before deploying a Node.js API, run the scanner to catch a committed AWS access key, an npm dependency with critical CVEs, and a wildcard CORS policy in one pass. ## Quick Start Scan my project directory for security vulnerabilities, exposed secrets, and dangerous code patterns, then summarize the critical findings.
