# Security Basics > Apply project-specific security and privacy guardrails (auth, headers, rate limiting, logging). Use when touching authentication, request handling, metrics exposure, or anything that could leak sensitive data. Use when this capability is needed. - Skill: `tomevault-io/security-basics` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/security-basics` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-basics/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/security-basics --- ## Tooling assumptions - Use a terminal runner with bash and git available. - Prefer `make` targets when available; fall back to direct CLI commands when needed. ## Authentication & secrets - Auth tokens: `AUTH_TOKENS` (preferred; comma-separated) or `AUTH_TOKEN` (legacy; single token). - Never hardcode tokens; use environment variables. - Avoid logging full URLs, tokens, session cookies, or authorization headers. ## Rate limiting & client IP - The rate limiter keys by client IP and may use `X-Forwarded-For` / `X-Real-IP`. - In production, ensure the reverse proxy strips/overwrites forwarding headers to prevent spoofing. ## Metrics exposure - `/metrics` may be public by default; enable protection when needed via `METRICS_AUTH_ENABLED=true`. ## Practical review checklist - Inputs validated (especially short codes and URLs). - Error responses don’t reveal internals/secrets. - CORS settings (`ALLOWED_ORIGINS`) are appropriate for production. - Secure cookies enabled (`SECURE_COOKIES=true`) when behind HTTPS. --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/matt-riley) — claim your Tome and manage your conversions.