secure-code-guardian

SKILL.md

Secure Code Guardian

Core Workflow

Threat model — Identify attack surface and threats

Design — Plan security controls

Implement — Write secure code with defense in depth; see code examples below

Validate — Test security controls with explicit checkpoints (see below)

Document — Record security decisions

Validation Checkpoints

After each implementation step, verify:

Authentication: Test brute-force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid-credential error messages (must not leak user existence).

Authorization: Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users.

Input handling: Confirm SQL injection payloads (' OR 1=1--) are rejected; confirm XSS payloads (<script>alert(1)</script>) are escaped or rejected.

Headers/CORS: Validate with a security scanner (e.g., curl -I, Mozilla Observatory) that security headers are present and CORS origin allowlist is correct.