# Security

> Security — Index

- Skill: `persimmon-automation-labs/security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add persimmon-automation-labs/security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/persimmon-automation-labs/security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Persimmon-Automation-Labs (https://skillmd.com/u/persimmon-automation-labs)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/persimmon-automation-labs/security

---


# Security — Index

Persimmon security = NextAuth v5 (credentials/OAuth) with a Prisma adapter and JWT sessions, plus a dedicated security review pass before delivery. This mother is a map; follow the child for the actual work.

## Trigger

- "Add auth / login" / "NextAuth" / "sessions" / "protect this route"
- "Security review" / "audit before delivery" / "check headers / CSP"

## The child skills

| Skill | When to use | Owns |
|---|---|---|
| `security-nextauth` | Implementing or fixing auth | NextAuth v5 credentials + Prisma adapter, JWT sessions, `trustHost: true`, middleware reading `x-forwarded-host`, route protection |
| `security-review` | Pre-delivery audit (also part of `quality`) | Headers, auth gaps, injection, secret exposure, CSP, dependency CVEs |

## How to route

1. **Auth work?** → `security-nextauth`.
2. **Auditing?** → `security-review` (invoked standalone or via `quality-final-review`).

## Persimmon security defaults — one-screen summary

- **NextAuth v5 behind Railway**: `trustHost: true` is mandatory; middleware redirects must read `x-forwarded-host` or users bounce to `*.up.railway.app`.
- **Secrets server-side only** — never `NEXT_PUBLIC_*`, never in client bundles.
- **Headers** in `next.config.ts`: HSTS, `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`.
- **Validate every boundary input** with Zod (see `stack-zod-boundary`).
- **Never log** secrets, PII, or document contents — redact in error reports.

## Anti-patterns banned

- NextAuth without `trustHost` behind a proxy
- Redirects using the internal host instead of `x-forwarded-host`
- Secrets in `NEXT_PUBLIC_*`
- Logging PII / document contents
- Missing security headers in `next.config.ts`

## Relationship to other mothers

| Mother | Connection |
|---|---|
| `stack` | Boundary validation via `stack-zod-boundary` |
| `quality` | `security-review` is one dimension of `quality-final-review` |
| `infra` | Header config ships in the deployed app (`infra-railway-deploy`) |