secure-fix-validation

---

name: secure-fix-validation description: Standard validation checklist to prove a security fix works and doesn’t regress behavior.

Use this skill after implementing a security fix, or when reviewing a PR.

Step-by-step process

1. Reproduce the issue pre-fix
   • Minimal failing test or request example
2. Verify the fix
   • Confirm the repro now fails safely
3. Regression coverage
   • Add unit/integration tests for:
     • expected valid inputs
     • malicious/edge inputs
     • authorization bypass attempts (if relevant)
4. Non-functional checks
   • Error handling (no stack traces/secret leakage)
   • Logging redaction (no PII/secrets)
   • Performance impact in hot paths
5. Rollout safety
   • Feature flags where appropriate
   • Backwards compatibility notes
   • Monitoring/alerts to detect new failure modes

Output

• Commands run
• Tests added/updated
• Verification evidence (logs/screenshots/snippets)
• Rollout notes