Harden
Security as a constraint on every line that touches user data, auth, or external systems. This skill is proactive: applied during implementation, not after. For reactive scans, use safe-repo (sensitive data) or deps-audit (CVEs).
Three-Tier Boundary System
Always do (no exceptions)
- Validate every external input at the system boundary (route handler, API entry)
- Parameterize all database queries (never concatenate user input into SQL)
- Encode output to prevent XSS — use framework auto-escaping, don't bypass it
- HTTPS for all external communication
- Hash passwords with bcrypt/scrypt/argon2 (salt rounds ≥ 12); never plaintext
- Set security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options
- Session cookies:
httpOnly, secure, sameSite
- Use environment variables for secrets; reference, never inline
- Strip sensitive fields from API responses by default
Ask first (human approval required)
- New authentication flow or auth logic changes
- Storing new categories of sensitive data (PII, payment)
- New external service integrations
- CORS configuration changes
- File upload handlers
- Rate-limit / throttling changes
- Granting elevated permissions or roles
Never do
- Commit secrets to version control
- Log sensitive data (passwords, tokens, full PAN)
- Trust client-side validation as a security boundary
- Disable security headers for convenience
- Use
eval() or innerHTML with user-provided data
- Store sessions in client-accessible storage (e.g., localStorage for auth tokens)
- Expose stack traces or internal errors to users
See OWASP Top 10 quick reference.
Input Validation at Boundaries
Always validate at the system boundary (route handler, message consumer), not in business logic:
- Schema validator (Zod, Joi, Yup, pydantic) defines the contract
- Reject with 422 + structured error before any business logic touches the data
- Trust internal code; validate only at the edges
File Upload Safety
- Allowlist MIME types; deny unknown
- Enforce max size before processing
- Check magic bytes if file type is security-critical (don't trust extension or
mimetype)
- Store outside webroot or behind authenticated access
Verification
After implementing security-relevant code, confirm:
Common Rationalizations
| Rationalization |
Reality |
| "Internal tool, security doesn't matter" |
Internal tools get compromised; attackers target the weakest link |
| "We'll add security later" |
Retrofitting is 10x harder than building it in |
| "No one would exploit this" |
Automated scanners will; security-by-obscurity is not security |
| "Framework handles security" |
Frameworks provide tools, not guarantees |
| "It's a prototype" |
Prototypes become production; habits compound |
1---2name: harden3description: Harden code proactively against vulnerabilities at the boundary where untrusted input enters the system. Use when implementing auth, handling user input, storing or transmitting sensitive data, integrating external APIs, adding file uploads, or any code that crosses a trust boundary. Don't use for reactive secret scanning (use `safe-repo`) or dependency CVE checks (use `deps-audit`).4---56# Harden78Security as a constraint on every line that touches user data, auth, or external systems. This skill is **proactive**: applied during implementation, not after. For reactive scans, use `safe-repo` (sensitive data) or `deps-audit` (CVEs).910## Three-Tier Boundary System1112### Always do (no exceptions)1314- Validate every external input at the system boundary (route handler, API entry)15- Parameterize all database queries (never concatenate user input into SQL)16- Encode output to prevent XSS — use framework auto-escaping, don't bypass it17- HTTPS for all external communication18- Hash passwords with bcrypt/scrypt/argon2 (salt rounds ≥ 12); never plaintext19- Set security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options20- Session cookies: `httpOnly`, `secure`, `sameSite`21- Use environment variables for secrets; reference, never inline22- Strip sensitive fields from API responses by default2324### Ask first (human approval required)2526- New authentication flow or auth logic changes27- Storing new categories of sensitive data (PII, payment)28- New external service integrations29- CORS configuration changes30- File upload handlers31- Rate-limit / throttling changes32- Granting elevated permissions or roles3334### Never do3536- Commit secrets to version control37- Log sensitive data (passwords, tokens, full PAN)38- Trust client-side validation as a security boundary39- Disable security headers for convenience40- Use `eval()` or `innerHTML` with user-provided data41- Store sessions in client-accessible storage (e.g., localStorage for auth tokens)42- Expose stack traces or internal errors to users4344See [OWASP Top 10 quick reference](references/owasp.md).4546## Input Validation at Boundaries4748Always validate at the **system boundary** (route handler, message consumer), not in business logic:4950- Schema validator (Zod, Joi, Yup, pydantic) defines the contract51- Reject with 422 + structured error before any business logic touches the data52- Trust internal code; validate only at the edges5354## File Upload Safety5556- Allowlist MIME types; deny unknown57- Enforce max size before processing58- Check magic bytes if file type is security-critical (don't trust extension or `mimetype`)59- Store outside webroot or behind authenticated access6061## Verification6263After implementing security-relevant code, confirm:6465- [ ] `deps-audit` shows no critical or high CVEs (or each is documented with review date)66- [ ] `safe-repo --diff` clean67- [ ] All user input validated at system boundaries68- [ ] Authorization checked on every protected endpoint (ownership, not just auth)69- [ ] Security headers present in response (check via DevTools or `curl -I`)70- [ ] Error responses don't expose internal details71- [ ] Rate limit active on auth endpoints7273## Common Rationalizations7475| Rationalization | Reality |76|-----------------|---------|77| "Internal tool, security doesn't matter" | Internal tools get compromised; attackers target the weakest link |78| "We'll add security later" | Retrofitting is 10x harder than building it in |79| "No one would exploit this" | Automated scanners will; security-by-obscurity is not security |80| "Framework handles security" | Frameworks provide tools, not guarantees |81| "It's a prototype" | Prototypes become production; habits compound |
helderberto