---

name: security-fundamentals description: | TRIGGERS: "is this secure?", "security review", "check for vulnerabilities", "auth check", "building auth", "implementing login", "storing passwords", "API keys", "user input", "adding authentication", "user credentials", "session handling", "token storage", authentication, authorization, input validation, SQL injection, XSS, OWASP, passwords, tokens, JWT. USE WHEN: Junior is BUILDING auth flows, handling user input, storing sensitive data, or working with APIs. PROVIDES: OWASP Top 10 checks, input validation patterns, auth best practices, security anti-patterns. PROACTIVE: Triggers when junior mentions building security-related features, not just reviewing.

Security Fundamentals Review

"Security is not a feature. It's a foundation. Build on sand, and the house falls."

When to Apply

Activate this skill when reviewing:

• Authentication/login flows
• Authorization checks
• User input handling
• Database queries
• File uploads
• API endpoints
• Data exposure in responses

---

Review Checklist

Input Validation (NEVER Trust the Client)

• All inputs validated: Is every user input checked before use?
• Server-side validation: Is validation done on the server, not just client?
• Type checking: Are expected types enforced?
• Length limits: Are string lengths bounded?
• Whitelist over blacklist: Are allowed values explicitly defined?

Authentication

• Password hashing: Are passwords hashed (bcrypt, argon2), not encrypted?
• No plaintext secrets: Are secrets in env vars, not code?
• Token expiry: Do JWTs/sessions have reasonable expiration?
• Secure transmission: Is HTTPS enforced?

Authorization

• Ownership checks: Can users only access THEIR data?
• Role verification: Are admin routes protected by role checks?
• No client-side auth: Is authorization enforced server-side?

Data Exposure

• Minimal response: Does the API return only necessary fields?
• No sensitive data in URLs: Are tokens/IDs not in query strings?
• No sensitive data in logs: Are passwords/tokens excluded from logs?

---

OWASP Top 10 Quick Check

1. Injection (SQL, NoSQL, Command)

Copy❌ db.query(`SELECT * FROM users WHERE id = ${userId}`);

✅ db.query('SELECT * FROM users WHERE id = ?', [userId]);

2. Broken Authentication

Copy❌ if (req.headers.admin === 'true') { /* allow admin */ }

✅ const user = await verifyToken(req.headers.authorization);
   if (user.role !== 'admin') throw new ForbiddenError();

3. Sensitive Data Exposure

Copy❌ res.json({ user: { ...user, password, ssn } });

✅ res.json({ user: { id: user.id, name: user.name } });

4. Broken Access Control

Copy❌ app.get('/users/:id', async (req, res) => {
     const user = await User.findById(req.params.id);
     res.json(user);
   });

✅ app.get('/users/:id', async (req, res) => {
     const user = await User.findById(req.params.id);
     if (user.id !== req.user.id && req.user.role !== 'admin') {
       throw new ForbiddenError();
     }
     res.json(user);
   });

5. Security Misconfiguration

Copy❌ CORS: origin: '*'
❌ Detailed error messages in production
❌ Debug mode enabled in production

✅ CORS: origin: process.env.ALLOWED_ORIGINS
✅ Generic error messages to clients
✅ Debug mode disabled in production

6. Cross-Site Scripting (XSS)

Copy❌ element.innerHTML = userInput;

✅ element.textContent = userInput;
✅ DOMPurify.sanitize(userInput);

---

Socratic Questions

Ask the junior these questions instead of giving answers:

1. Trust: "What stops a malicious user from sending anything they want here?"
2. Ownership: "How do you know this user owns this resource?"
3. Exposure: "What's the worst thing that could happen if this endpoint is exposed?"
4. Secrets: "If I git clone this repo, what secrets would I see?"
5. Injection: "What if someone sends '; DROP TABLE users; -- as input?"

---

Red Flags to Call Out

---

Security Checklist Before Deploy

1. All secrets in environment variables
2. HTTPS enforced
3. Input validation on all endpoints
4. SQL/NoSQL injection prevented (parameterized queries)
5. XSS prevented (output encoding)
6. CSRF protection enabled
7. Rate limiting on auth endpoints
8. Sensitive data excluded from responses
9. Authorization checks on every protected route
10. Security headers set (helmet.js or equivalent)

---

Never Do This