security-checklist

---

name: security-checklist description: Security patterns and OWASP checklist. Auto-loads when handling auth, user input, API security, or reviewing code for vulnerabilities.

Security checklist for identifying vulnerabilities and ensuring secure coding practices.

For detailed checklists, see checklist.md. For framework-specific patterns, see patterns.md.

---

OWASP Top 10

---

Quick Scan Commands

Copy# Check for secrets in code
grep -rE "(password|secret|api_key|token)\s*[:=]" --include="*.{ts,js,json,env}" .

# Find SQL injection risks
grep -rE "query\(.*\+.*\)|execute\(.*\+.*\)" --include="*.ts" .

# Check for dangerouslySetInnerHTML
grep -r "dangerouslySetInnerHTML" --include="*.tsx" .

# Audit packages
bun pm audit

---

Security Mindset

• Defense in depth - Multiple layers, not single points
• Least privilege - Minimum access needed
• Fail secure - Errors should deny, not allow
• Trust nothing - Validate everything from outside
• Keep secrets secret - Never in code, logs, or errors