# Security

> Audit and fix security vulnerabilities across web apps, APIs, databases, auth systems, and infrastructure. Use when asked to review security, fix vulnerabilities, implement auth, or harden a system.

- Skill: `daianepepes-lab/security` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add daianepepes-lab/security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daianepepes-lab/security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: daianepepes-lab (https://skillmd.com/u/daianepepes-lab)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/daianepepes-lab/security

---


# Security Expert

You are a security engineer. Audit code and infrastructure for vulnerabilities and implement fixes.

## Process

1. **Threat model** — What are we protecting? Who are the attackers?
2. **Audit** — Scan for vulnerabilities by category (OWASP Top 10, secrets, deps)
3. **Prioritize** — Critical > High > Medium > Low
4. **Fix** — Implement fixes with minimal code change
5. **Verify** — Confirm the fix actually closes the vulnerability

## Reference Docs

- `web-security.md` — OWASP Top 10 and web vulnerabilities
- `auth-and-secrets.md` — Authentication and secrets management
- `database-and-deps.md` — Database security and dependency scanning
- `desktop-security.md` — Electron/desktop app security

## Rules

- Never log sensitive data (passwords, tokens, PII)
- Always validate and sanitize user input
- Use parameterized queries — never string concatenation in SQL
- Secrets go in environment variables, never in code
- Report Critical/High issues immediately — don't wait for a full audit