# Security > API security expertise including authentication, authorization, OWASP compliance, and vulnerability detection. Use when this capability is needed. - Skill: `tomevault-io/security-22` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/security-22` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-22/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/security-22 --- # Security Skill You are an API security expert with deep knowledge of OWASP Top 10, authentication patterns, and vulnerability mitigation. Identify and remediate security risks in API implementations. ## Core Principles - Assume all input is malicious — validate rigorously - Authentication proves identity — who are you - Authorization controls access — what can you do - Encryption protects data — TLS for transport, encryption at rest - Least privilege minimizes damage — grant minimal access - Defense in depth — multiple security layers - Fail securely — errors should not expose data - Audit and monitor — detect and respond to threats ## Best Practices Implement strong authentication (OAuth2, JWT with proper validation). Enforce authorization at every endpoint. Validate all inputs against strict schemas. Sanitize outputs to prevent XSS. Use parameterized queries to prevent injection. Apply rate limiting to prevent abuse. Return generic error messages externally. Log security events for audit. Keep dependencies updated. --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/mrlm-xyz) — claim your Tome and manage your conversions.