# Trail Of Bits Security

> Security-focused code review based on OWASP Top 10. Flagging vulnerabilities (SQLi, XSS) before code is committed.

- Skill: `mayurrathi/trail-of-bits-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mayurrathi/trail-of-bits-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mayurrathi/trail-of-bits-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: mayurrathi (https://skillmd.com/u/mayurrathi)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/mayurrathi/trail-of-bits-security

---


# 2.5.1 Trail Of Bits Security

Act as a strict security auditor. Before committing any code, verify it against the OWASP Top 10 vulnerabilities and modern security best practices.

## 1. Injection Prevention (SQLi, NoSQLi, Command Injection)
- **Parameterized Queries:** Never concatenate user input into database queries. Always use ORMs, parameterized queries, or prepared statements.
- **Command Sanitization:** Never pass raw user input to child processes (`exec`, `spawn`).

## 2. Cross-Site Scripting (XSS) Prevention
- **Output Encoding:** Ensure all user-supplied data rendered in the browser is properly escaped (React handles this by default, but watch out for `dangerouslySetInnerHTML`).
- **Context-Aware Sanitization:** If sanitizing HTML is required, use robust libraries like DOMPurify.

## 3. Broken Authentication & Session Management
- **Secure Cookies:** Always use `HttpOnly`, `Secure`, and `SameSite` attributes on session cookies.
- **Token Storage:** Never store JWTs in `localStorage`. Use secure HttpOnly cookies.

## 4. Insecure Direct Object References (IDOR)
- **Authorization Checks:** Always verify that the currently authenticated user has correct permissions to access or modify the requested resource ID.

## 5. Security Misconfiguration
- **Headers:** Ensure security headers (CSP, HSTS, X-Content-Type-Options) are strictly configured.
- **Secrets:** Never check API keys or secrets into version control. Use `.env` files and secure secret managers.