Security Skill Security best practices and automated security testing for all projects. Core Principle Security is not optional. Every project must pass security checks before merge. Assume all input is malicious, all secrets will leak if committed, and all dependencies have vulnerabilities. Required Security Setup 1. Gitignore (Non Negotiable) Every project must have these in .gitignore : 2. Environment Variables Create .env.example with all required vars (no values): Frontend Environment Variables (Critical!) NEVER put secrets in client exposed env vars: Framework Client Exposed Prefix Server Only Vite VITE No prefix Next.js NEXT PUBLIC No prefix Create React App REACT APP N/A (no server) Vercel Environment Variables: In Vercel dashboard, secrets without VITE prefix are server only Only VITE vars are bundled into client code Always verify in browser devtools → Sources → your bundle that secrets aren't exposed Validate environment at startup: Security Tests Pre Commit Security Checks Add to pre commit hooks: For all projects: TypeScript/JavaScript: Python: Security Check Script Create scripts/security check.sh : GitHub Actions Security Workflow Create .github/workflows/security.yml : Input Validation (OWASP Top 10) 1. SQL Injection Prevention Never use string concatenation: 2. XSS Prevention 3. Input Validation at Boundaries 4. Path Traversal Prevention Authentication & Authorization JWT Best Practices Password Hashing Rate Limiting Security Headers Security Testing Checklist Run before every release: Security Anti Patterns ❌ Secrets in VITE , NEXT PUBLIC , or REACT APP env vars (client exposed!) ❌ Secrets in code or config files committed to git ❌ .env files without .gitignore entry ❌ String concatenation for SQL queries ❌ dangerouslySetInnerHTML without sanitization ❌ eval() or new Function() with user input ❌ Passwords stored as plain text or weak hash (MD5, SHA1) ❌ JWTs with no expiration or very long expiration ❌ No rate limiting on authentication endpoints ❌ Logging sensitive data (passwords, tokens, PII) ❌ Using for CORS origins in production ❌ Ignoring npm audit / safety check warnings ❌ Running as root / admin in production ❌ Hardcoded credentials for any environment ❌ Disabling SSL/TLS verification