aibot88 Security Sentinel (World-Class Security Skill)
When to Use
ALWAYS use this skill when:
- Writing/reviewing API routes (especially POST/PATCH/PUT/DELETE)
- Implementing authentication or authorization
- Handling user input (forms, query params, file uploads)
- Working with database queries
- Processing file operations
- Managing environment variables and secrets
- Building payment processing features
- Implementing session management
- Handling sensitive data or encryption
- Before creating pull requests
- Before deployment
Comprehensive Documentation
This skill includes complete security references:
📚 Core References (10,426 lines total)
owasp-top-10-complete.md (2,133 lines) - Complete OWASP Top 10 with code examples
- A01: Broken Access Control (IDOR, path traversal)
- A02: Cryptographic Failures (weak hashing, hardcoded secrets)
- A03: Injection (SQL, NoSQL, Command injection)
- A04: Insecure Design (race conditions, rate limiting)
- A05: Security Misconfiguration (CORS, error messages)
- A06: Vulnerable Components (dependency management)
- A07: Authentication Failures (weak passwords, MFA)
- A08: Integrity Failures (supply chain, deserialization)
- A09: Logging Failures (audit trails, monitoring)
- A10: SSRF (URL validation, IP blocking)
authentication-patterns.md (1,529 lines) - Complete authentication guide
- JWT token authentication
- Session-based authentication
- Password hashing (bcrypt, Argon2)
- Password reset flow
- Email verification
- Multi-factor authentication (TOTP)
- OAuth 2.0 (GitHub, Google)
- Passwordless authentication (magic links)
- Refresh token pattern
authorization-patterns.md (1,062 lines) - Access control implementation
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- Middleware protection
- API route protection
- Server Action protection
- Row-level security (Drizzle patterns)
- Permission system
- Resource ownership validation
input-validation-complete.md (900 lines) - Zod validation for everything
- String, number, boolean, enum validation
- Email, URL, phone, UUID validation
- File upload validation (images, PDFs, CSVs)
- Password strength requirements
- Credit card validation (Luhn algorithm)
- IP address validation (v4, v6)
- Async validation (database checks)
- Error handling and display
sql-injection-prevention.md (741 lines) - Drizzle ORM security
- Parameterized queries (always safe)
- Dynamic query building
- Raw SQL safety patterns
- LIKE query sanitization
- Database schema security
- Testing for SQL injection
xss-prevention.md (630 lines) - React/Next.js XSS protection
- React's built-in escaping
- dangerouslySetInnerHTML with DOMPurify
- URL sanitization
- Content Security Policy (CSP)
- User-generated content handling
- innerHTML safety
csrf-prevention.md (597 lines) - Cross-Site Request Forgery protection
- SameSite cookies (primary defense)
- CSRF tokens implementation
- Double submit cookie pattern
- Server Actions protection
- Origin header validation
secret-management.md (547 lines) - Secure secret handling
- Environment variables best practices
- Secret rotation strategies
- Encryption at rest (AES-256-GCM)
- Secret detection (gitleaks, trufflehog)
- Production secrets (Vercel, AWS, Vault)
rate-limiting-patterns.md (826 lines) - Prevent API abuse
- In-memory rate limiting
- Redis-based rate limiting
- API route protection
- Server Action protection
- IP-based rate limiting
- User-based rate limiting
- Sliding window algorithm
- Token bucket algorithm
security-checklist.md (471 lines) - Pre-deployment audit (250+ items)
- Authentication security (passwords, sessions, JWT, MFA)
- Authorization security (access control, RLS)
- Input validation
- Data security (secrets, logging, database)
- File upload security
- Rate limiting
- Security headers (CSP, CORS, HSTS)
- Error handling
- Dependency security
- Monitoring and logging
- Infrastructure security
- Compliance (GDPR, PCI DSS)
🛠️ Security Tools
- validate-security.py (414 lines) - Automated vulnerability scanner
- Detects 20+ vulnerability types
- Scans for hardcoded secrets (API keys, passwords, tokens)
- Checks for SQL injection patterns
- Detects XSS vulnerabilities (dangerouslySetInnerHTML, innerHTML)
- Finds eval() and Function() usage
- Identifies weak cryptography (MD5, SHA1)
- Detects insecure randomness
- Checks for command injection
- Validates path traversal prevention
- Tests password hashing strength
- Audits JWT security
- Checks CORS configuration
- Validates cookie security (httpOnly, secure)
- Reports TypeScript issues (@ts-ignore, any)
- Exits with error on CRITICAL/HIGH issues
- Identifies XSS vulnerabilities
- Finds eval() and Function() usage
- Detects weak cryptography (MD5, SHA1)
- Checks for command injection
- Validates password hashing
- Finds CORS misconfigurations
- Checks for missing httpOnly cookies
- Reports TypeScript issues (@ts-ignore, any types)
🚀 Quick Start
Before implementing ANY security-sensitive feature:
# 1. Read the relevant guide
cat owasp-top-10-complete.md
cat authentication-patterns.md
# 2. Implement following patterns
# 3. Run security scanner
python validate-security.py src/
# 4. Check against security checklist
cat security-checklist.md
When to Use
OWASP Top 10 Security Checks
1. Injection Attacks
SQL Injection
// ❌ DON'T: String concatenation in queries
const query = `SELECT * FROM users WHERE email = '${email}'`
// Vulnerable to: email = "' OR '1'='1"
// ✅ DO: Use Prisma (parameterized queries)
const user = await prisma.user.findUnique({
where: { email },
})
Command Injection
// ❌ DON'T: Unvalidated shell commands
const fileName = req.body.fileName
exec(`cat ${fileName}`) // Vulnerable to: fileName = "; rm -rf /"
// ✅ DO: Validate input and use safe APIs
const allowedFiles = ['log.txt', 'data.csv']
if (!allowedFiles.includes(fileName)) {
throw new Error('Invalid file name')
}
const content = await fs.readFile(path.join(SAFE_DIR, fileName))
NoSQL Injection
// ❌ DON'T: Direct object insertion
const user = await db.users.findOne({ email: req.body.email })
// Vulnerable to: { email: { $ne: null } }
// ✅ DO: Validate input with Zod
const emailSchema = z.string().email()
const email = emailSchema.parse(req.body.email)
const user = await db.users.findOne({ email })
2. Broken Authentication
Password Storage
// ❌ DON'T: Plain text passwords
const user = await prisma.user.create({
data: {
email,
password, // Never store plain text!
},
})
// ✅ DO: Hash with bcrypt
import bcrypt from 'bcrypt'
const hashedPassword = await bcrypt.hash(password, 12) // 12 rounds minimum
const user = await prisma.user.create({
data: {
email,
password: hashedPassword,
},
})
Session Management
// ❌ DON'T: Weak session tokens
const sessionId = Math.random().toString()
// ✅ DO: Cryptographically secure tokens
import crypto from 'crypto'
const sessionId = crypto.randomBytes(32).toString('hex')
// ✅ DO: Set secure session cookie
res.setHeader('Set-Cookie', [
`session=${sessionToken}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`,
])
JWT Security
// ❌ DON'T: Weak secret
const token = jwt.sign(payload, 'secret123')
// ✅ DO: Strong secret from environment
const token = jwt.sign(payload, process.env.JWT_SECRET!, {
expiresIn: '1h',
algorithm: 'HS256',
})
// ✅ DO: Verify JWT properly
try {
const decoded = jwt.verify(token, process.env.JWT_SECRET!)
// Use decoded data
} catch (error) {
throw new Error('Invalid token')
}
3. Sensitive Data Exposure
Environment Variables
// ❌ DON'T: Hardcoded secrets
const apiKey = 'sk_live_abc123def456'
const dbPassword = 'mypassword123'
// ✅ DO: Environment variables
const apiKey = process.env.STRIPE_API_KEY
const dbPassword = process.env.DATABASE_PASSWORD
if (!apiKey || !dbPassword) {
throw new Error('Missing required environment variables')
}
Data in Logs
// ❌ DON'T: Log sensitive data
console.log('User data:', { email, password, creditCard })
// ✅ DO: Redact sensitive fields
const safeUserData = {
email,
creditCard: creditCard.slice(-4).padStart(creditCard.length, '*'),
}
console.log('User data:', safeUserData)
Never Return Sensitive Data
// ❌ DON'T: Return password in API
const user = await prisma.user.findUnique({ where: { id } })
return user // Includes password hash!
// ✅ DO: Exclude sensitive fields
const user = await prisma.user.findUnique({
where: { id },
select: {
id: true,
email: true,
name: true,
// password field excluded
},
})
return user
4. XML External Entities (XXE)
// ❌ DON'T: Parse untrusted XML
const doc = xmlParser.parse(userInput)
// ✅ DO: Disable external entities
const parser = new xml2js.Parser({
explicitChildren: false,
explicitRoot: false,
ignoreAttrs: true,
xmlns: false,
})
5. Broken Access Control
Authorization Checks
// ❌ DON'T: Missing authorization
export async function DELETE(
request: Request,
{ params }: { params: { id: string } }
) {
await prisma.project.delete({ where: { id: params.id } })
return new Response(null, { status: 204 })
}
// ✅ DO: Verify ownership
export async function DELETE(
request: Request,
{ params }: { params: { id: string } }
) {
const user = await getAuthUser(request)
if (!user) {
return new Response('Unauthorized', { status: 401 })
}
const project = await prisma.project.findUnique({
where: { id: params.id },
})
if (!project) {
return new Response('Not found', { status: 404 })
}
if (project.userId !== user.id) {
return new Response('Forbidden', { status: 403 })
}
await prisma.project.delete({ where: { id: params.id } })
return new Response(null, { status: 204 })
}
IDOR (Insecure Direct Object Reference)
// ❌ DON'T: Trust user input for IDs
const userId = req.query.userId
const data = await getPrivateData(userId) // Any user can access any data!
// ✅ DO: Use authenticated user's ID
const userId = req.user.id // From authenticated session
const data = await getPrivateData(userId)
6. Security Misconfiguration
CORS
// ❌ DON'T: Allow all origins
res.setHeader('Access-Control-Allow-Origin', '*')
// ✅ DO: Whitelist specific origins
const allowedOrigins = [
'https://app.quetrex.com',
'https://staging.quetrex.com',
]
const origin = req.headers.get('origin')
if (origin && allowedOrigins.includes(origin)) {
res.setHeader('Access-Control-Allow-Origin', origin)
}
Error Messages
// ❌ DON'T: Expose internal details
catch (error) {
res.status(500).json({
error: error.message, // Could leak stack trace, DB structure, etc.
})
}
// ✅ DO: Generic error messages
catch (error) {
console.error('Internal error:', error) // Log internally
res.status(500).json({
error: 'An internal error occurred',
})
}
7. Cross-Site Scripting (XSS)
dangerouslySetInnerHTML
// ❌ DON'T: Unsanitized HTML
<div dangerouslySetInnerHTML={{ __html: userInput }} />
// Vulnerable to: userInput = "<script>alert('XSS')</script>"
// ✅ DO: Sanitize with DOMPurify
import DOMPurify from 'dompurify'
const sanitized = DOMPurify.sanitize(userInput)
<div dangerouslySetInnerHTML={{ __html: sanitized }} />
// ✅ BETTER: Avoid dangerouslySetInnerHTML entirely
<div>{userInput}</div> // React escapes by default
URL Handling
// ❌ DON'T: Unsanitized URLs
<a href={userInput}>Click here</a>
// Vulnerable to: userInput = "javascript:alert('XSS')"
// ✅ DO: Validate URLs
function isSafeUrl(url: string): boolean {
try {
const parsed = new URL(url)
return ['http:', 'https:'].includes(parsed.protocol)
} catch {
return false
}
}
const href = isSafeUrl(userInput) ? userInput : '#'
<a href={href}>Click here</a>
8. Insecure Deserialization
// ❌ DON'T: eval() or Function()
const code = req.body.code
eval(code) // NEVER DO THIS
// ❌ DON'T: Unvalidated JSON
const data = JSON.parse(userInput)
// Use data directly without validation
// ✅ DO: Validate with Zod
const data = JSON.parse(userInput)
const validated = dataSchema.parse(data) // Validates structure and types
9. Using Components with Known Vulnerabilities
# ✅ DO: Regular dependency audits
npm audit --audit-level=high
# ✅ DO: Keep dependencies updated
npm update
# ✅ DO: Use automated tools
npm install -g snyk
snyk test
10. Insufficient Logging & Monitoring
// ❌ DON'T: No logging
export async function POST(request: Request) {
const user = await createUser(data)
return Response.json(user)
}
// ✅ DO: Log security events
export async function POST(request: Request) {
try {
const user = await createUser(data)
logger.info('User created', {
userId: user.id,
email: user.email,
ip: request.headers.get('x-forwarded-for'),
timestamp: new Date().toISOString(),
})
return Response.json(user)
} catch (error) {
logger.error('User creation failed', {
error: error.message,
email: data.email,
ip: request.headers.get('x-forwarded-for'),
timestamp: new Date().toISOString(),
})
throw error
}
}
Input Validation Checklist
// ✅ Complete input validation example
import { z } from 'zod'
const createUserSchema = z.object({
email: z.string().email().max(255),
password: z
.string()
.min(8, 'Password must be at least 8 characters')
.max(128)
.regex(/[A-Z]/, 'Password must contain uppercase letter')
.regex(/[a-z]/, 'Password must contain lowercase letter')
.regex(/[0-9]/, 'Password must contain number')
.regex(/[^A-Za-z0-9]/, 'Password must contain special character'),
name: z.string().min(1).max(100).optional(),
})
export async function POST(request: Request) {
// 1. Parse and validate input
const body = await request.json()
const validated = createUserSchema.parse(body) // Throws on validation error
// 2. Additional business logic validation
const existing = await prisma.user.findUnique({
where: { email: validated.email },
})
if (existing) {
throw new Error('Email already exists')
}
// 3. Hash password
const hashedPassword = await bcrypt.hash(validated.password, 12)
// 4. Create user
const user = await prisma.user.create({
data: {
email: validated.email,
password: hashedPassword,
name: validated.name,
},
select: {
id: true,
email: true,
name: true,
// password excluded
},
})
// 5. Log security event
logger.info('User registered', { userId: user.id, email: user.email })
return Response.json(user, { status: 201 })
}
Security Headers
// ✅ DO: Set security headers
export function middleware(request: NextRequest) {
const response = NextResponse.next()
response.headers.set('X-Content-Type-Options', 'nosniff')
response.headers.set('X-Frame-Options', 'DENY')
response.headers.set('X-XSS-Protection', '1; mode=block')
response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
response.headers.set(
'Content-Security-Policy',
"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';"
)
response.headers.set(
'Strict-Transport-Security',
'max-age=31536000; includeSubDomains'
)
return response
}
Security Review Checklist
For each code change, verify:
- All user input validated with Zod
- No hardcoded secrets (use environment variables)
- SQL queries parameterized (using Prisma)
- Passwords hashed with bcrypt (12+ rounds)
- JWT tokens use strong secret and expire
- Authorization checks on all protected routes
- No dangerouslySetInnerHTML without DOMPurify
- No eval() or Function() with user input
- CORS configured for specific origins
- Error messages don't leak internal details
- Security headers set correctly
- Sensitive data excluded from API responses
- Security events logged
- Dependencies audited (npm audit)
- HTTPS enforced in production