# Security > Security best practices Use when this capability is needed. - Skill: `tomevault-io/security-25` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/security-25` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-25/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/security-25 --- Always check for and prevent: 1. SQL injection - use parameterized queries only 2. XSS - escape all user input in HTML output 3. CSRF - use tokens for state-changing requests 4. Hardcoded secrets - use environment variables 5. Insecure dependencies - check npm audit / pip audit 6. Missing input validation - validate all user inputs 7. Improper error exposure - don't leak stack traces 8. Missing authentication - verify auth on all protected routes 9. Broken access control - check authorization for every action 10. Sensitive data exposure - encrypt at rest and in transit --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/agricidaniel) — claim your Tome and manage your conversions.