# Mern Sec

> Security policy for MERN apps. Enforces OWASP Top 10 and CWE Top 25 mitigations.

- Skill: `majiayu000/mern-sec` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/mern-sec`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/mern-sec/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/mern-sec

---


## Purpose

Ensure MERN code is secure by default. For security output format and core refusal policy, see `/shared-sec-baseline`.

## MERN-specific security concerns (always check)

1. **NoSQL injection** — reject `$`-prefixed and dot-notation keys from user input
2. **Input validation** — schema validation (Zod/Joi) at every API boundary
3. **XSS** — React escapes by default; audit `dangerouslySetInnerHTML` and raw HTML rendering
4. **CSRF** — required when using cookie-based auth; use tokens or SameSite=Strict
5. **Auth/authz gaps** — verify authorization on every protected route handler, not just frontend
6. **Token storage** — avoid localStorage for sensitive tokens without justification; prefer httpOnly cookies

## Standard security (brief check)

- Error responses: safe envelopes, no stack traces or internal details
- Rate limiting: on auth endpoints, expensive operations, public APIs
- Dependencies: lockfile committed, no known critical vulnerabilities

## Reference

For detailed OWASP/CWE mitigation patterns, see `reference/mern-sec-reference.md`