# Security Compliance

> Implement comprehensive security for shared library. Use when working with security audits, dependency vulnerabilities, API security, token encryption, or secure coding practices for library consumers. Library security impacts all consuming plugins.

- Skill: `majiayu000/security-compliance` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-compliance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-compliance/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-compliance

---


# Security & Compliance Guardian

## Mission
Ensure Lidarr.Plugin.Common provides secure foundation for all consuming plugins through comprehensive security practices and secure defaults.

## Current Security Infrastructure
- ✅ **CodeQL Scanning**: Weekly automated scans
- ✅ **Secret Scanning**: GitLeaks active + historical
- ✅ **Dependency Review**: PR-based vulnerability checks
- ✅ **OpenSSF Scorecard**: Weekly security assessment
- ✅ **Token Encryption**: DPAPI/Keychain/SecretService support
- ✅ **Azure Key Vault**: Optional encrypted storage

## Library-Specific Security

### Secure Defaults
- All APIs secure by default
- No insecure opt-in options
- Fail-secure error handling
- Encrypted token storage

### Consumer Impact
- Security issues affect ALL plugins
- Breaking fixes may require major versions
- Clear security migration guides
- Responsible disclosure process

## Expertise Areas

### 1. Secure API Design
- Input validation patterns
- Output sanitization
- Error handling without information leakage
- Cryptographic best practices

### 2. Authentication Security
- OAuth 2.0 + PKCE implementation
- Token storage encryption
- Session management security
- Credential rotation support

### 3. Data Protection
- At-rest encryption (DPAPI, Keychain, Secret Service)
- In-transit security (TLS/HTTPS enforcement)
- Azure Key Vault integration
- Secure cache management

### 4. Supply Chain Security
- Package signing (NuGet)
- Dependency pinning and lock files
- SBOM for library releases
- Transitive dependency monitoring

### 5. Vulnerability Management
- CVE monitoring and response
- Security advisory creation (GitHub)
- Breaking security fixes process
- Backport security patches to old versions

## Enhancement Opportunities
1. **Package Signing**: Sign NuGet packages with certificate
2. **Security Documentation**: Consumer security guide
3. **Threat Model**: Library-specific threat analysis
4. **Fuzzing**: Add fuzz testing for parsers and validators
5. **Penetration Testing**: Regular third-party security audits

## Security Checklist for Library
- [ ] All APIs have input validation
- [ ] Secrets encrypted at rest
- [ ] TLS/HTTPS enforced
- [ ] No default credentials
- [ ] Secure error messages
- [ ] Regular dependency updates
- [ ] Security advisories documented
- [ ] Breaking security fixes have migration guide

## Related Skills
- `api-versioning` - Security through API contracts
- `release-automation` - Secure releases with SBOM

## Examples

### Example 1: Handle Security Vulnerability in Dependency
**User**: "FluentValidation has a critical CVE"
**Action**: Assess impact, update version, test compatibility, create security advisory, release patch for supported versions

### Example 2: Add Token Encryption
**User**: "Implement encrypted token storage"
**Action**: Use DPAPI (Windows), Keychain (macOS), Secret Service (Linux), add Azure Key Vault support, document usage

### Example 3: Security Audit Findings
**User**: "Penetration test found API key in logs"
**Action**: Remove sensitive data from logs, add log scrubbing, update documentation, release hotfix, notify consumers