Security patterns

Skill edjchapman/claude-code-config/skills/security-patterns

Auth, input-validation, and secrets conventions. Use when writing or reviewing authentication, authorization, middleware, routes, JWT, CSRF, or CORS code; for a full audit of pending changes use /security-review.From its SKILL.md

Install

npx -y skills add edjchapman/claude-code-config --skill security-patterns

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

8 stars8 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.1 KB, as published. Nobody here has run it

Security Patterns

Apply these security practices when writing or reviewing code in auth, middleware, and API layers.

Input Validation

Always validate at system boundaries (API endpoints, form handlers, message consumers)
Never trust client-side validation alone
Use allowlists over denylists for input filtering
Validate types, lengths, ranges, and formats
Sanitize HTML output to prevent XSS (use framework auto-escaping)

SQL Injection Prevention

Always use parameterized queries or ORM methods
Never construct SQL with string concatenation or f-strings
Django: use QuerySet methods, Q objects, or params argument for raw SQL
Node.js: use query builders (Knex) or ORM (Prisma, TypeORM) -- never template literals in SQL

# WRONG
User.objects.raw(f"SELECT * FROM users WHERE email = '{email}'")

# CORRECT
User.objects.raw("SELECT * FROM users WHERE email = %s", [email])
User.objects.filter(email=email)

Authentication

Hash passwords with bcrypt, argon2, or scrypt (never MD5/SHA alone)
Enforce minimum password complexity at registration
Rate-limit login attempts (exponential backoff or account lockout)
Use constant-time comparison for tokens and secrets
Invalidate sessions on password change

JWT / Token Security

Set short expiration times (15min for access tokens, days for refresh)
Store refresh tokens server-side (database or Redis)
Never store sensitive data in JWT payload (it's base64, not encrypted)
Validate iss, aud, and exp claims on every request
Use RS256 or ES256 over HS256 for multi-service architectures

CSRF Protection

Enable framework CSRF middleware (Django: CsrfViewMiddleware)
Use SameSite=Lax or Strict on session cookies
For SPAs: use token-based auth or double-submit cookies
Never disable CSRF protection for convenience

Authorization

Check permissions on every request, not just in UI
Use role-based or attribute-based access control
Verify object ownership: if obj.owner != request.user: return 403
Log authorization failures for monitoring

Secrets Management

Never hardcode secrets, API keys, or passwords in code
Use environment variables or secret managers (AWS Secrets Manager, Vault)
Add .env and credential files to .gitignore
Rotate secrets on schedule and after any suspected breach

HTTP Security Headers

Ensure these headers are set in production:

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin

Logging

Log authentication events (login, logout, failed attempts)
Log authorization failures
Never log passwords, tokens, API keys, or PII
Include request IDs for traceability