# Appsec > Application security - OWASP, validation, secrets. Use when securing the app. Use when this capability is needed. - Skill: `tomevault-io/appsec` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/appsec` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/appsec/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/appsec --- # AppSec Guideline ## Tech Stack * **Rate Limiting**: Upstash Redis * **Framework**: Next.js * **Platform**: Vercel ## Non-Negotiables * OWASP Top 10:2025 vulnerabilities must be addressed * CSP, HSTS, X-Frame-Options, X-Content-Type-Options headers must be present * CSRF protection on state-changing requests * No plaintext passwords in logs, returns, storage, or telemetry * MFA required for Admin/SUPER_ADMIN roles * Required configuration must fail-fast at build/startup if missing * Secrets must not be hardcoded or committed ## Context Security isn't a feature — it's a foundational property. A single vulnerability can compromise everything else. The review should think like an attacker: where are the weak points? What would I exploit? Beyond fixing vulnerabilities, consider the security architecture holistically. Is defense-in-depth implemented? Are there single points of failure? Would you trust this system with your own data? ## Driving Questions * What would an attacker target first? * Where is rate limiting missing or insufficient? * What attack vectors exist in authentication flows? * How are secrets managed and what's the rotation strategy? * What happens when a secret is compromised — is incident response exercisable? * Where does "security by obscurity" substitute for real controls? --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/sylphxai) — claim your Tome and manage your conversions.