# Security

> Applies secure-by-default engineering checks. Use before release, when handling auth/secrets, or after se_security_audit findings.

- Skill: `samraddhashrivastavatech/security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add samraddhashrivastavatech/security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/samraddhashrivastavatech/security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: SAMRADDHASHRIVASTAVATECH (https://skillmd.com/u/samraddhashrivastavatech)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/samraddhashrivastavatech/security

---


# Security

- Run `se_security_audit` on the project.
- Android: also `android_security_audit`.
- SQL: never disable MCP write gates to "make the demo work".
- No hardcoded API keys. Use env vars.
- Allowlisted subprocess only (already true in these MCPs).
- Web: no innerHTML with user data; no eval.
- Dependencies: pin when shipping; `confirm=true` on install.
- Office macros: detect, never execute (Office MCP).
- Don't copy keystore passwords into README.