Security
Overview
Security is a cross-cutting concern that spans every layer of software development, from design through deployment and operations. Rather than being confined to a single language or framework, security principles such as defense in depth, least privilege, and secure defaults apply universally. This skill serves as the root entry point for all security-related guidance, organizing sub-skills around the major domains of application security: standards compliance (OWASP), threat modeling, authentication and authorization, cryptography, API security, input validation, data protection, supply chain integrity, security testing, logging and monitoring, secure SDLC practices, and the emerging field of AI security. Use this skill to navigate the security landscape and identify which specialized sub-skill addresses your specific concern.
Knowledge Map
+-----------------------------------------------------------------------+
| Governance & Compliance |
| (Secure SDLC, Policies, Standards, Regulations) |
+-----------------------------------------------------------------------+
| Application Security |
| +-------------+ +-----------+ +--------------+ +---------------+ |
| +--------+ +--------+ +-----------+ +-----------+ +--------+ |
| | Auth | | Crypto | |Input/Output| |API Security| |Hygiene | |
| |(AuthN/Z)| |(TLS,HE)| |(Validate) | |(REST,GQL) | |(Trust | |
| +--------+ +--------+ +-----------+ +-----------+ |Boundaries)| |
| +--------+ |
| +---------------------+ +--------------------------------------+ |
| | Data Protection | | Supply Chain Security | |
| | (Encryption at Rest, | | (Dependencies, SBOMs, Signing) | |
| | Masking, PII) | +--------------------------------------+ |
| +---------------------+ |
+-----------------------------------------------------------------------+
| Foundation |
| +------------------+ +-------------------+ +--------------------+ |
| +----------------+ +----------------+ +------------------+ +--------+ |
| | Threat Modeling | | Security Tests | | Logging/Monitor | | Pen | |
| | (STRIDE,DREAD) | | (SAST,DAST,SCA)| | (SIEM,Alerting) | | Test & | |
| +----------------+ +----------------+ +------------------+ | Red | |
| | Team | |
| +--------+ |
+-----------------------------------------------------------------------+
| <<cross-cutting>> AI Security |
| (Prompt Injection, Model Poisoning, LLM Top 10, AI Supply Chain) |
+-----------------------------------------------------------------------+
Canonical Works
| Title |
Author(s) |
Year |
Focus |
| The Web Application Hacker's Handbook |
Dafydd Stuttard & Marcus Pinto |
2011 |
Web app vulnerability discovery and exploitation techniques |
| Penetration Testing |
Georgia Weidman |
2014 |
Hands-on penetration testing methodology and tools |
| Red Team Development and Operations |
Joe Vest & James Tubberville |
2020 |
Planning and executing red team engagements |
| Threat Modeling: Designing for Security |
Adam Shostack |
2014 |
Systematic approach to identifying and mitigating security threats |
| NIST Cybersecurity Framework 2.0 |
NIST |
2024 |
Risk-based framework for managing cybersecurity across organizations |
| OWASP Top 10 (2021) |
OWASP Foundation |
2021 |
Top 10 most critical web application security risks |
| OWASP API Security Top 10 (2023) |
OWASP Foundation |
2023 |
Top 10 most critical API security risks |
| OWASP Top 10 for LLM Applications (2025) |
OWASP Foundation |
2025 |
Top 10 security risks specific to large language model applications |
Choosing the Right Sub-Skill
| Problem |
Look In |
| Need to understand common web vulnerabilities and compliance baselines |
owasp |
| Designing a system and need to identify threats early |
threat-modeling |
| Implementing login, OAuth, SSO, or access control |
authentication |
| Choosing or implementing encryption, hashing, or key management |
cryptography |
| Securing REST or GraphQL APIs against abuse |
api-security |
| Sanitizing user input or preventing injection attacks |
input-validation |
| Enforcing sanitization and canonicalization at every component boundary (including internal data) |
hygiene |
| Protecting PII, encrypting data at rest, or masking sensitive fields |
data-protection |
| Auditing dependencies, generating SBOMs, or verifying artifact integrity |
supply-chain |
| Running SAST, DAST, or SCA scans in CI/CD |
security-testing |
| Setting up security logging, alerting, or incident detection |
logging-monitoring |
| Embedding security gates into the development lifecycle |
secure-sdlc |
| Securing LLM-powered applications against prompt injection or model abuse |
ai-security |
| Planning or conducting authorized penetration tests against applications and infrastructure |
penetration-testing |
| Adversarial red team engagements, MITRE ATT&CK simulation, purple teaming, AI red teaming |
red-teaming |
Best Practices
- Defense in depth: never rely on a single security control; layer multiple defenses so that a failure in one does not compromise the system.
- Least privilege: grant the minimum permissions necessary for any user, service, or process to perform its function.
- Secure defaults: ship systems in a secure configuration; require explicit action to weaken security posture rather than to strengthen it.
- Shift left: integrate security analysis (threat modeling, SAST, dependency scanning) as early as possible in the development lifecycle.
- Zero trust mindset: authenticate and authorize every request regardless of network location; assume the perimeter has already been breached.
- Automate security gates: use CI/CD pipelines to enforce security scanning, secret detection, and compliance checks before code reaches production.
- Keep dependencies current: regularly update libraries and frameworks, monitor for CVEs, and generate Software Bills of Materials (SBOMs) for auditability.
- Treat security as a team responsibility: security is not solely the security team's job; every developer, operator, and architect shares accountability for building and maintaining secure systems.
1---2name: security3description: Use when addressing cross-cutting security concerns that apply to all languages, frameworks, and platforms. Covers OWASP standards, threat modeling, authentication, cryptography, supply chain security, and AI security. USE FOR: application security strategy, security architecture, choosing security controls, OWASP compliance, security tool selection, secure development lifecycle DO NOT USE FOR: specific language security implementations (use language-specific skills), infrastructure hardening (use iac skills), network security appliance configuration4license: MIT5---67# Security89## Overview1011Security is a cross-cutting concern that spans every layer of software development, from design through deployment and operations. Rather than being confined to a single language or framework, security principles such as defense in depth, least privilege, and secure defaults apply universally. This skill serves as the root entry point for all security-related guidance, organizing sub-skills around the major domains of application security: standards compliance (OWASP), threat modeling, authentication and authorization, cryptography, API security, input validation, data protection, supply chain integrity, security testing, logging and monitoring, secure SDLC practices, and the emerging field of AI security. Use this skill to navigate the security landscape and identify which specialized sub-skill addresses your specific concern.1213## Knowledge Map1415```16+-----------------------------------------------------------------------+17| Governance & Compliance |18| (Secure SDLC, Policies, Standards, Regulations) |19+-----------------------------------------------------------------------+20| Application Security |21| +-------------+ +-----------+ +--------------+ +---------------+ |22| +--------+ +--------+ +-----------+ +-----------+ +--------+ |23| | Auth | | Crypto | |Input/Output| |API Security| |Hygiene | |24| |(AuthN/Z)| |(TLS,HE)| |(Validate) | |(REST,GQL) | |(Trust | |25| +--------+ +--------+ +-----------+ +-----------+ |Boundaries)| |26| +--------+ |27| +---------------------+ +--------------------------------------+ |28| | Data Protection | | Supply Chain Security | |29| | (Encryption at Rest, | | (Dependencies, SBOMs, Signing) | |30| | Masking, PII) | +--------------------------------------+ |31| +---------------------+ |32+-----------------------------------------------------------------------+33| Foundation |34| +------------------+ +-------------------+ +--------------------+ |35| +----------------+ +----------------+ +------------------+ +--------+ |36| | Threat Modeling | | Security Tests | | Logging/Monitor | | Pen | |37| | (STRIDE,DREAD) | | (SAST,DAST,SCA)| | (SIEM,Alerting) | | Test & | |38| +----------------+ +----------------+ +------------------+ | Red | |39| | Team | |40| +--------+ |41+-----------------------------------------------------------------------+42| <<cross-cutting>> AI Security |43| (Prompt Injection, Model Poisoning, LLM Top 10, AI Supply Chain) |44+-----------------------------------------------------------------------+45```4647## Canonical Works4849| Title | Author(s) | Year | Focus |50|-------|-----------|------|-------|51| The Web Application Hacker's Handbook | Dafydd Stuttard & Marcus Pinto | 2011 | Web app vulnerability discovery and exploitation techniques |52| Penetration Testing | Georgia Weidman | 2014 | Hands-on penetration testing methodology and tools |53| Red Team Development and Operations | Joe Vest & James Tubberville | 2020 | Planning and executing red team engagements |54| Threat Modeling: Designing for Security | Adam Shostack | 2014 | Systematic approach to identifying and mitigating security threats |55| NIST Cybersecurity Framework 2.0 | NIST | 2024 | Risk-based framework for managing cybersecurity across organizations |56| OWASP Top 10 (2021) | OWASP Foundation | 2021 | Top 10 most critical web application security risks |57| OWASP API Security Top 10 (2023) | OWASP Foundation | 2023 | Top 10 most critical API security risks |58| OWASP Top 10 for LLM Applications (2025) | OWASP Foundation | 2025 | Top 10 security risks specific to large language model applications |5960## Choosing the Right Sub-Skill6162| Problem | Look In |63|---------|---------|64| Need to understand common web vulnerabilities and compliance baselines | `owasp` |65| Designing a system and need to identify threats early | `threat-modeling` |66| Implementing login, OAuth, SSO, or access control | `authentication` |67| Choosing or implementing encryption, hashing, or key management | `cryptography` |68| Securing REST or GraphQL APIs against abuse | `api-security` |69| Sanitizing user input or preventing injection attacks | `input-validation` |70| Enforcing sanitization and canonicalization at every component boundary (including internal data) | `hygiene` |71| Protecting PII, encrypting data at rest, or masking sensitive fields | `data-protection` |72| Auditing dependencies, generating SBOMs, or verifying artifact integrity | `supply-chain` |73| Running SAST, DAST, or SCA scans in CI/CD | `security-testing` |74| Setting up security logging, alerting, or incident detection | `logging-monitoring` |75| Embedding security gates into the development lifecycle | `secure-sdlc` |76| Securing LLM-powered applications against prompt injection or model abuse | `ai-security` |77| Planning or conducting authorized penetration tests against applications and infrastructure | `penetration-testing` |78| Adversarial red team engagements, MITRE ATT&CK simulation, purple teaming, AI red teaming | `red-teaming` |7980## Best Practices8182- **Defense in depth**: never rely on a single security control; layer multiple defenses so that a failure in one does not compromise the system.83- **Least privilege**: grant the minimum permissions necessary for any user, service, or process to perform its function.84- **Secure defaults**: ship systems in a secure configuration; require explicit action to weaken security posture rather than to strengthen it.85- **Shift left**: integrate security analysis (threat modeling, SAST, dependency scanning) as early as possible in the development lifecycle.86- **Zero trust mindset**: authenticate and authorize every request regardless of network location; assume the perimeter has already been breached.87- **Automate security gates**: use CI/CD pipelines to enforce security scanning, secret detection, and compliance checks before code reaches production.88- **Keep dependencies current**: regularly update libraries and frameworks, monitor for CVEs, and generate Software Bills of Materials (SBOMs) for auditability.89- **Treat security as a team responsibility**: security is not solely the security team's job; every developer, operator, and architect shares accountability for building and maintaining secure systems.
Tyler-R-Kendrick