Aeo Security

Use when reviewing code for security, performing a security audit, checking for OWASP Top 10 vulnerabilities, fixing injection flaws, preventing XSS, securing authentication, or checking access control. Covers every category with detection patterns, vulnerable and fixed code examples, and prevention checklists - broken access control, cryptographic failures, injection including SQL and command injection, insecure design, security misconfiguration, vulnerable and outdated components, identification and authentication failures, software and data integrity failures, security logging and monitoring failures, and SSRF. For auditing existing code; for writing new code safely, use secure-coding.

Use when validating user input, handling a file upload, managing secrets, implementing authentication, handling authorization, encoding output, choosing cryptography, or applying secure defaults while writing code. Covers validation strategy and common validations, XSS prevention through output encoding and Content Security Policy, the secret storage hierarchy and what to do after a secret is exposed, password handling, JWT tokens and session management, role-based and resource-level access control, which cryptographic primitive to use when, and secure random number generation. For writing safe code; to audit existing code against the OWASP Top 10, use owasp-top-10.