Security Expert Skill
Expert in application security for React, Next.js, and NestJS applications.
When to Use This Skill
- Implementing authentication or authorization
- Reviewing code for security vulnerabilities
- Setting up security configurations
- Handling sensitive data
- Implementing encryption or hashing
- Configuring CORS, CSP, or security headers
- Reviewing dependencies for vulnerabilities
- Implementing multi-tenancy or data isolation
Project Context Discovery
- Check
.agents/SYSTEM/ARCHITECTURE.md for security architecture
- Review
.agents/SYSTEM/critical/CRITICAL-NEVER-DO.md for security rules
- Identify security patterns and tools
- Check for
[project]-security-expert skill
Core Security Principles
Authentication & Authorization
Authentication: Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO
Authorization: RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement
Input Validation
- DTOs with class-validator
- Sanitize user input
- Prevent NoSQL/SQL injection
- Parameterized queries
Data Protection
- Encryption at rest and in transit
- Passwords hashed (never plaintext)
- Environment variables for secrets
- No secrets in code
Security Headers
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Strict-Transport-Security
- Content Security Policy
OWASP Top 10 Quick Reference
- Broken Access Control: Verify auth on all endpoints
- Cryptographic Failures: Strong encryption, proper hashing
- Injection: Parameterized queries, input validation
- Insecure Design: Security by design, threat modeling
- Security Misconfiguration: Secure defaults, remove unused features
- Vulnerable Components: Keep dependencies updated
- Authentication Failures: Strong passwords, MFA, brute force protection
- Integrity Failures: Secure CI/CD, code signing
- Logging Failures: Comprehensive logging, monitoring
- SSRF: Validate URLs, whitelist domains
Security Checklist Summary
For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see: references/full-guide.md
1---2name: security-expert-33description: Expert in application security, OWASP Top 10, authentication, authorization, data protection, and security best practices for React, Next.js, and NestJS applications4---56# Security Expert Skill78Expert in application security for React, Next.js, and NestJS applications.910## When to Use This Skill1112- Implementing authentication or authorization13- Reviewing code for security vulnerabilities14- Setting up security configurations15- Handling sensitive data16- Implementing encryption or hashing17- Configuring CORS, CSP, or security headers18- Reviewing dependencies for vulnerabilities19- Implementing multi-tenancy or data isolation2021## Project Context Discovery22231. Check `.agents/SYSTEM/ARCHITECTURE.md` for security architecture242. Review `.agents/SYSTEM/critical/CRITICAL-NEVER-DO.md` for security rules253. Identify security patterns and tools264. Check for `[project]-security-expert` skill2728## Core Security Principles2930### Authentication & Authorization3132**Authentication:** Secure password hashing (bcrypt/argon2), JWT management, session security, MFA, OAuth/SSO3334**Authorization:** RBAC, permission checks on all endpoints, resource-level auth, multi-tenancy enforcement3536### Input Validation3738- DTOs with class-validator39- Sanitize user input40- Prevent NoSQL/SQL injection41- Parameterized queries4243### Data Protection4445- Encryption at rest and in transit46- Passwords hashed (never plaintext)47- Environment variables for secrets48- No secrets in code4950### Security Headers5152- X-Content-Type-Options: nosniff53- X-Frame-Options: DENY54- Strict-Transport-Security55- Content Security Policy5657## OWASP Top 10 Quick Reference58591. **Broken Access Control:** Verify auth on all endpoints602. **Cryptographic Failures:** Strong encryption, proper hashing613. **Injection:** Parameterized queries, input validation624. **Insecure Design:** Security by design, threat modeling635. **Security Misconfiguration:** Secure defaults, remove unused features646. **Vulnerable Components:** Keep dependencies updated657. **Authentication Failures:** Strong passwords, MFA, brute force protection668. **Integrity Failures:** Secure CI/CD, code signing679. **Logging Failures:** Comprehensive logging, monitoring6810. **SSRF:** Validate URLs, whitelist domains6970## Security Checklist Summary7172- [ ] Passwords hashed (bcrypt/argon2)73- [ ] All endpoints protected74- [ ] Multi-tenancy enforced75- [ ] All inputs validated76- [ ] Encryption at rest/transit77- [ ] Security headers configured78- [ ] CORS properly configured79- [ ] Dependencies up to date8081---8283**For complete authentication/authorization patterns, input validation examples, OWASP prevention techniques, framework-specific security (React/Next.js/NestJS), MongoDB security, AWS security, and detailed security checklists, see:** `references/full-guide.md`
shipshitdev