# Security

> Use this skill when implementing any feature that touches user data, auth, APIs, file uploads, pe...

- Skill: `saranskumar/security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add saranskumar/security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/saranskumar/security/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: saranskumar (https://skillmd.com/u/saranskumar)
- Updated: 2026-08-19
- Page: https://skillmd.com/skills/saranskumar/security

---


# Security Skill

Use this skill when implementing any feature that touches user data, auth, APIs, file uploads, permissions, or external integrations.
Also use it as a review pass before marking any feature done.

---

## When to activate this skill

- Adding a new API endpoint or route
- Implementing login, registration, or session management
- Adding file upload or user-generated content
- Changing permissions or access control
- Integrating a third-party service
- Pre-deployment review of any feature

---

## Security Review Process

### Step 1: Map the attack surface
- What inputs does this feature accept? (forms, query params, headers, file uploads, webhooks)
- What data does it read or write?
- Who is allowed to access it?
- What can go wrong if this is exploited?

### Step 2: Input security
- [ ] All inputs validated and typed before use
- [ ] File uploads: type-checked, size-limited, stored safely
- [ ] No raw user input passed to queries, eval, exec, or shell commands
- [ ] Query parameters are sanitized and typed

### Step 3: Auth + Authorization
- [ ] Endpoint requires authentication (not just UI guard)
- [ ] Endpoint checks authorization (right role/permission for this resource)
- [ ] Ownership is enforced — users can only access their own data unless explicitly authorized
- [ ] Admin-only routes are verified server-side, not just hidden in UI

### Step 4: Data exposure
- [ ] Response returns only what the caller is authorized to see
- [ ] No passwords, tokens, secrets, or internal IDs in responses
- [ ] Error messages don't expose stack traces, file paths, or DB structure

### Step 5: Transport + Environment
- [ ] Feature works only over HTTPS
- [ ] Secrets are in environment variables, not in code or logs
- [ ] CORS is configured correctly if this is a new endpoint

### Step 6: Dependency & audit check
- [ ] Any new library added does not have known critical CVEs
- [ ] Run `pnpm audit` (or stack equivalent) before release

---

## Output

- Security review notes (what was checked)
- Identified risks (if any)
- Fixes applied or recommended

---

## Rule

A feature without a security review is not done.
Security is not a separate phase — it is part of implementation.