Secure coding, injection defense, secrets, dependency & supply-chain risk

Security guidance covering the secure coding checklist, authn/authz threat-model and hardening, input validation and injection defense, secrets and config management, dependency and supply-chain risk, infrastructure and access control, business-logic/webhook security, and security testing.

Resource files

secure-coding-checklist.md

Quick OWASP-Top-10-mapped pass over any change

authn-authz-patterns.md

Login, sessions, MFA, password reset, IDOR/BOLA, privilege checks

input-validation-and-injection.md

SQL/NoSQL injection, XSS, CSRF, uploads, path traversal, SSRF

secrets-and-config-management.md

Credentials, .env files, secrets in git/JS/logs, cookies, storage

dependency-and-supply-chain.md

Vulnerable/malicious packages, CI/CD supply-chain risk

infrastructure-and-access-control.md

Cloud/DB permissions, admin routes, headers, CORS, rate limits

business-logic-and-webhooks.md

Payments, webhooks, business-logic abuse, race conditions

security-testing.md

How to actually test security controls, not just implement them

external-skills-map.md

When security-review should lead instead of this skill