security-and-hardening

Security and Hardening - Web Application Security Hardening Guide

Skill Overview

Security and Hardening provides security-first best practices for Web application development, covering input validation, authentication, OWASP Top 10 protection, secret management, and supply chain security. It helps developers build reliable applications that defend against common attacks.

Applicable Scenarios

1. Handling User Input and External Data

When an application accepts user input, file uploads, webhook callbacks, or data from third-party APIs, use this skill to implement input validation, SQL injection protection, and XSS protection. Every external input boundary is a potential attack surface, so all untrusted data must be validated and sanitized.

2. Implementing Authentication and Authorization

When building login systems, session management, permission controls, or handling sensitive data (PII, payment information), this skill provides best practices for password hashing, session security configuration, CORS settings, and access control to prevent identity spoofing and privilege escalation attacks.

3. Integrating External Services and AI Features

When connecting to third-party APIs, processing webhooks, implementing file uploads, or integrating LLM/AI functionality, this skill guides you in preventing SSRF attacks, managing API keys, validating LLM outputs, and restricting AI agent permissions to ensure external integrations do not become security vulnerabilities.

Core Features

1. Threat Modeling and OWASP Protection

Provides the STRIDE threat modeling methodology to help developers identify trust boundaries, asset value, and attack surfaces before coding. Covers protection patterns for the OWASP Top 10, including SQL injection, authentication failures, XSS, broken access control, security misconfiguration, sensitive data exposure, and SSRF. Each threat includes specific code examples and mitigation measures.

2. Input Validation and Output Encoding

Requires validating all external input at system boundaries (API routes, form handlers), using parameterized queries to prevent SQL injection, and automatically encoding output to prevent XSS. Provides secure file upload checks, schema validation examples, and practical patterns for safely handling URLs, JSON, and form data.

3. Supply Chain and Secret Management

Provides guidance on auditing dependency vulnerabilities (distinguishing critical/high/moderate severity and exploitability), configuring secure response headers (CSP, HSTS, X-Frame-Options), managing environment variables and secrets, implementing rate limiting, and preventing secrets from being exposed in version control systems. Includes special security considerations for LLM/AI applications, such as model output validation, tool permission restrictions, and prompt injection protection.

Frequently Asked Questions

What types of projects is the Security and Hardening skill applicable to?

This skill applies to all Web application projects that handle user data, integrate with external services, or require authentication. Whether you are building an internal tool or a public-facing service, these security practices are necessary whenever you accept HTTP requests, store user data, or call external APIs. It is especially applicable to high-security environments such as e-commerce, SaaS, fintech, and healthcare.

How can SQL injection and XSS attacks be prevented?

The key to preventing SQL injection is to never concatenate user input into SQL statements. Use parameterized queries or an ORM such as Prisma, allowing the database driver to handle escaping. For XSS, rely on your framework’s automatic escaping, such as React’s, and avoid using innerHTML or eval() to process user data directly. If you must render HTML, use a library such as DOMPurify to sanitize it. Remember: all external input, including LLM output, should be treated as untrusted.

How should secrets and sensitive data be managed?

Never commit secrets, passwords, or tokens to version control. Use .env files to store sensitive configuration, and add .env to .gitignore. In production, inject secrets through environment variables or a secret management service such as AWS Secrets Manager. For passwords, use bcrypt/scrypt/argon2 hashing (salt rounds ≥ 12); never store plaintext passwords. Sensitive fields (passwordHash, resetToken) should be excluded from API responses. If a secret has been exposed, rotate it immediately—deleting it from the code is not enough; it must be revoked and reissued.