# Financial Platform Security

> Use when implementing Spring Security 6, JWT/Session authentication, RBAC, PII masking, and HMAC message integrity verification.

- Skill: `sahilkhan30/financial-platform-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sahilkhan30/financial-platform-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sahilkhan30/financial-platform-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: SahilKhan30 (https://skillmd.com/u/sahilkhan30)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/sahilkhan30/financial-platform-security

---


# Financial Platform Security Skill

## Purpose
Standardize authentication, authorization, PII protection, and message integrity across financial applications.

---

## 1. Principles & Rules

### MANDATORY
- **PII Protection**: Sensitive PII data (PAN, Aadhaar, VPA, Card Number) MUST be masked in logs and encrypted at rest (`e.g. 4532-XXXX-XXXX-8921`).
- **Input Parameterization**: Use JPA parameterization and sanitized inputs to prevent SQL injection and XSS vulnerabilities.

### REQUIREMENT-DRIVEN SECURITY
- **Authentication & CSRF**: Derive authentication mechanism (stateless JWT vs session cookies) from explicit application requirements.
  - If authentication uses stateless bearer tokens (JWT) in headers, CSRF protection may be disabled (`csrf -> csrf.disable()`).
  - If authentication relies on browser cookies, CSRF protection MUST NOT be blindly disabled.
- **HMAC Signatures**: Apply HMAC payload signature verification (`X-Signature`) ONLY when external message authenticity/integrity is explicitly required by gateway integration specifications.