# Security Guidance

> Security guidance and best practices for code development. Use when writing authentication code, handling sensitive data, validating user input, designing APIs, or reviewing code for security issues.

- Skill: `majiayu000/security-guidance-3` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-guidance-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-guidance-3/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: See original LICENSE
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-guidance-3

---


# Security Guidance

Security guidance and best practices for code development.

This skill provides security-focused guidance to help identify and prevent common security vulnerabilities.

## When to Use This Skill

Use this skill when:
- Writing code that handles sensitive data
- Implementing authentication or authorization
- Working with user input or external data
- Designing APIs or network services
- Reviewing code for security issues
- Learning security best practices

## Common Security Concerns

### Input Validation
- SQL injection prevention
- Cross-site scripting (XSS) protection
- Command injection avoidance
- Path traversal prevention

### Authentication & Authorization
- Secure password handling
- Session management
- Role-based access control
- Token security

### Data Protection
- Encryption at rest and in transit
- Secure storage of secrets
- Data minimization principles
- Privacy by design

### API Security
- Rate limiting
- Input validation
- Error handling (avoid information leakage)
- Secure headers and CORS

## Usage Example

```
# General security check:
"Review this code for security issues"

# Specific concerns:
"Check for SQL injection vulnerabilities"
"Validate the authentication implementation"
"Review API security headers"
```

## Security Mindset

1. **Principle of least privilege** - Only grant necessary permissions
2. **Defense in depth** - Multiple layers of security
3. **Fail securely** - Default to secure state on failure
4. **Keep it simple** - Complexity breeds vulnerabilities
5. **Assume breach** - Design for detection and containment

## Implementation Guidance

- Use established libraries for security functions
- Keep dependencies updated
- Implement proper logging and monitoring
- Regular security testing and code review
- Stay informed about new vulnerabilities

## Resources

- OWASP Top 10
- CWE/SANS Top 25
- Platform-specific security guides
- Security framework documentation

---

## Quick Checklist

Before deploying code, verify:
- [ ] All user inputs are validated and sanitized
- [ ] No hardcoded secrets or credentials
- [ ] Proper error handling without information leakage
- [ ] Authentication and authorization checks in place
- [ ] HTTPS/TLS for all network communications
- [ ] Dependencies are up-to-date and scanned for vulnerabilities