# Krajh Oc Kickstart Security Best Practices > Security Best Practices - Skill: `tomevault-io/krajh-oc-kickstart-security-best-practices` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/krajh-oc-kickstart-security-best-practices` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/krajh-oc-kickstart-security-best-practices/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/krajh-oc-kickstart-security-best-practices --- # Security Best Practices ## Overview Identify all languages and frameworks in the project scope. Then apply security best practices for those technologies. ## Workflow 1. **Identify** — Determine all languages and frameworks in the project 2. **Apply** — Use security best practices for the identified technologies 3. **Detect** — Passively flag critical vulnerabilities while working 4. **Report** — If requested, produce a prioritized security report ## General Security Advice ### Avoid Using Incrementing IDs for Public IDs When assigning IDs exposed to the internet, use UUID4 or random hex strings instead of auto-incrementing IDs. This prevents users from learning resource quantities and guessing IDs. ### TLS Warning Be careful about reporting lack of TLS as a security issue in development environments. Most dev work uses TLS disabled or provided by a proxy. Also be cautious with "secure" cookies — they MUST only be set over TLS. ## Passive Detection Guidelines - Focus on **critical and high-severity** vulnerabilities - Report passively found issues to the user, ask if they want fixes - Avoid fighting with the user if they choose to bypass a best practice ## Report Format (if requested) When producing a security report: 1. **Executive summary** at the top 2. **Severity sections** — Critical → High → Medium → Low 3. **Line numbers** when referencing code 4. **Impact statement** for each critical finding ## Fixes - Fix one finding at a time - Include comments explaining the security rationale - Assess second-order impacts before making changes - Follow project's existing change/commit flow --- > Source: [krajh/oc-kickstart](https://github.com/krajh/oc-kickstart) — distributed by [TomeVault](https://tomevault.io).