# Security > Security guidelines and OWASP Top 10. Use when reviewing security, implementing authentication or authorization, hardening code, or discussing vulnerabilities. Use when this capability is needed. - Skill: `tomevault-io/security-20` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/security-20` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-20/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/security-20 --- # Security This skill provides universal security guidelines and OWASP Top 10 best practices applicable to any technology stack. See @REFERENCE.md for detailed documentation. ## Quick Reference - **Validation**: Always server-side, never trust client input - **Queries**: Parameterized only (no SQL concatenation) - **Passwords**: Hash with bcrypt/Argon2 (never MD5/SHA1) - **Secrets**: Environment variables or vault (never in code) - **Headers**: CSP, X-Frame-Options, HSTS, nosniff --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/thebeardedbearsas) — claim your Tome and manage your conversions.