Use when implementing security best practices - comprehensive security guide for developers covering common vulnerabilities and secure coding practices
This skill provides essential security knowledge and best practices for developers, covering common vulnerabilities, secure coding patterns, and security implementation guidelines.
Use this skill when:
| Topic | Best Practices |
|---|---|
| Passwords | Hash with bcrypt/argon2, enforce strength requirements |
| Sessions | Use secure cookies, implement expiration, rotate tokens |
| MFA | Offer two-factor authentication |
| OAuth | Use established providers, validate tokens |
| JWT | Sign properly, set short expiration, validate claims |
// Always validate and sanitize input
const validator = require('validator');
// Validate email
if (!validator.isEmail(email)) {
throw new Error('Invalid email');
}
// Sanitize string
const clean = validator.escape(userInput);
| Vulnerability | Prevention |
|---|---|
| Injection | Use parameterized queries, ORM |
| XSS | Escape output, CSP headers |
| CSRF | CSRF tokens, SameSite cookies |
| Broken Auth | Strong password policies, MFA |
| Sensitive Data | Encryption at rest and transit |
| XXE | Disable XML external entities |
| Broken Access Control | Implement proper authorization |
| Security Misconfiguration | Harden servers, remove defaults |
| Known Vulnerabilities | Update dependencies regularly |
| Insufficient Logging | Log security events, monitor |
// Rate limiting
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100 // limit each IP to 100 requests per windowMs
});
// CORS configuration
app.use(cors({
origin: 'https://trusted-domain.com',
credentials: true
}));
// Security headers
app.use(helmet());
<!-- Content Security Policy -->
<meta http-equiv="Content-Security-Policy"
content="default-src 'self'; script-src 'self'">
<!-- HTTPS enforcement -->
<meta http-equiv="Strict-Transport-Security"
content="max-age=31536000; includeSubDomains">
When helping with security implementation:
fe-interview-questions - Security interview questionsawesome-python - Python security librariesbrowser-use - Security testing automationC:\Users\user\.qwen\skills\security-guide