Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating

Secure Code Guardian Core Workflow 1. Threat model — Identify attack surface and threats 2. Design — Plan security controls 3. Implement — Write secure code with defense in depth; see code examples below 4. Validate — Test security controls with explicit checkpoints (see below) 5. Document — Record security decisions Validation Checkpoints After each implementation step, verify: Authentication : Test brute force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid credential error messages (must not leak user existence). Authorization : Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users. Input handling : Confirm SQL injection payloads ( ' OR 1=1 ) are rejected; confirm XSS payloads ( <script alert(1)</script ) are escaped or rejected. Headers/CORS : Validate with a security scanner (e.g., curl I , Mozilla Observatory) that security headers are present and CORS origin allowlist is correct. Reference Guide Load detailed guidance based on context: Topic Reference Load When OWASP references/owasp prevention.md OWASP Top 10 patterns Authentication references/authentication.md Password hashing, JWT Input Validation references/input validation.md Zod, SQL injection XSS/CSRF references/xss csrf.md XSS prevention, CSRF Headers references/security headers.md Helmet, rate limiting Constraints MUST DO Hash passwords with bcrypt/argon2 (never MD5/SHA 1/unsalted hashes) Use parameterized queries (never string interpolated SQL) Validate and sanitize all user input before use Implement rate limiting on auth endpoints Set security headers (CSP, HSTS, X Frame Options) Log security events (failed auth, privilege escalation attempts) Store secrets in environment variables or secret managers (never in source code) MUST NOT DO Store passwords in plaintext or reversibly encrypted form Trust user input without validation Expose sensitive data in logs or error responses Use weak or deprecated algorithms (MD5, SHA 1, DES, ECB mode) Hardcode secrets or credentials in code Code Examples Password Hashing (bcrypt) Parameterized SQL Query (Node.js / pg) Input Validation with Zod JWT Validation Securing an Endpoint — Full Flow Output Templates When implementing security features, provide: 1. Secure implementation code 2. Security considerations noted 3. Configuration requirements (env vars, headers) 4. Testing recommendations Knowledge Reference OWASP Top 10, bcrypt/argon2, JWT, OAuth 2.0, OIDC, CSP, CORS, rate limiting, input validation, output encoding, encryption (AES, RSA), TLS, security headers [Documentation](https://jeffallan.github.io/claude skills/skills/security/secure code guardian/)

secure-code-guardian