# Security Engineering

> Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).

- Skill: `lazyisefficient/security-engineering` (Agent Skill, multi-file: 11 files)
- Install (CLI): `npx skillmds@latest add lazyisefficient/security-engineering`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lazyisefficient/security-engineering/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: LazyIsEfficient (https://skillmd.com/u/lazyisefficient)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/lazyisefficient/security-engineering

---


# Security Engineering

Cross-stack security rules covering API security, infrastructure hardening, Web3 smart contracts, CI/CD review automation, and agentic AI risks. Aligned to OWASP Top 10:2025, ASVS 5.0, and OWASP Agentic Security Initiative 2026.

When reviewing code, think like a senior security researcher: trace user input through to sensitive operations, prefer fail-closed designs, and never trust the client.

## Universal Rules

- **Validate every input server-side** with Zod (or equivalent) at the API boundary.
- **Parameterize all queries** — Prisma/Drizzle, never string concatenation.
- **Authorize on every request** — deny by default, verify ownership.
- **Hash passwords with Argon2 or bcrypt** — never MD5/SHA1, never plaintext.
- **No hardcoded secrets** — env vars validated at startup, secrets in vault, `.env` in `.gitignore`.
- **TLS everywhere**, encryption at rest on all data stores.
- **Fail-closed** on auth/permission errors. Never expose stack traces to users.
- **Log security events** with sanitization — redact `authorization`, `cookie`, CSRF headers.
- **Least-privilege IAM** — scope to specific actions and resource ARNs, not `*`.
- **OIDC for CI/CD** — no long-lived credentials in GitHub.
- **Smart contracts**: ReentrancyGuard, SafeERC20, signed data must include `chainid + address(this) + deadline`, replay-prevention via `usedHashes`.

## References

- [references/owasp-top-10.md](references/owasp-top-10.md) — OWASP Top 10:2025 quick reference table
- [references/cicd-security.md](references/cicd-security.md) — CI/CD security review methodology, scanned vulnerability categories, supply-chain check
- [references/api-security.md](references/api-security.md) — auth patterns, Zod validation, rate limiting, CORS, headers, log sanitization, error handling
- [references/infrastructure-security.md](references/infrastructure-security.md) — VPC isolation, Cloudflare Zero Trust, secrets management, encryption, IAM principles
- [references/web3-smart-contracts.md](references/web3-smart-contracts.md) — required patterns, signature verification, on-chain rate limits, audit findings, Slither
- [references/code-review-checklist.md](references/code-review-checklist.md) — full checklist by category (input, auth, access control, data, errors, Web3)
- [references/secure-code-patterns.md](references/secure-code-patterns.md) — SQLi, command injection, access control, fail-closed, password storage examples
- [references/agentic-ai-security.md](references/agentic-ai-security.md) — OWASP 2026 ASI01-10 + agent security checklist
- [references/asvs-5.md](references/asvs-5.md) — L1/L2/L3 requirements
- [references/language-specific.md](references/language-specific.md) — JS/TS, Solidity, Python, Go, Bash risks + deep analysis mindset

## Related skills

- [web3-smart-contract-engineering](../web3-smart-contract-engineering/SKILL.md) — Solidity patterns, signature verification, replay protection (consult alongside `references/web3-smart-contracts.md` when auditing contracts)
- [deployment-pipelines](../deployment-pipelines/SKILL.md) — pipeline hardening, OIDC, untrusted-input handling in CI
- [godot-engineer](../godot-engineer/SKILL.md) — multiplayer games have real security concerns: cheating, save tampering, server-side validation, anti-replay. Pull this in for any networked game.