# Security Baseline

> Security requirements, threats, and controls that apply across this system.

- Skill: `majiayu000/security-baseline-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-baseline-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-baseline-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-baseline-2

---


# Security Baseline

## Threat Model (High Level)

- Primary users: [internal / external]
- Assets to protect:
  - [e.g., customer PII, payment data, secrets]
- Primary threats:
  - [e.g., unauthorized access, data exfiltration, data tampering]

## Required Controls

### Authentication

- Use [e.g., OAuth2 / OIDC / SSO] for user identity.
- Never build custom password handling if avoidable.

### Authorization

- Enforce least privilege.
- Centralize authorization decisions when possible.

### Input Validation & Output Encoding

- Validate all untrusted input at boundaries.
- Sanitize or encode output where appropriate (HTML, JSON, SQL, etc.).

### Secrets Management

- Store secrets in [vault / secret manager], never in code or config files.
- Rotate secrets according to policy.

### Logging & Auditing

- Log security-relevant events:
  - Logins, permission changes, critical operations.
- Avoid logging sensitive data.

## Common Vulnerabilities

See `vulnerabilities.md` for patterns to search for and avoid.

## Security Testing Requirements

See `security-testing.md` for:
- Required automated checks
- Manual review steps for critical flows