> common-security-standards
Universal security protocols for safe, resilient software. Use when implementing authentication, encryption, authorization, or any security-sensitive feature. (triggers: **/*.ts, **/*.tsx, **/*.go, **/*.dart, **/*.java, **/*.kt, **/*.swift, **/*.py, security, encrypt, authenticate, authorize)
curl "https://skillshub.wtf/HoangNguyen0403/agent-skills-standard/common-security-standards?format=md"Security Standards - High-Density Standards
Universal security protocols for building safe and resilient software.
Priority: P0 (CRITICAL)
🛡 Data Safeguarding
- Zero Trust: Never trust external input. Sanitize and validate every data boundary (API, UI, CSV).
- Least Privilege: Grant minimum necessary permissions to users, services, and containers.
- No Hardcoded Secrets: Use environment variables or secret managers. Never commit keys or passwords.
- Encryption: Use modern, collision-resistant algorithms (AES-256 for data-at-rest; TLS 1.3 for data-in-transit).
- PII Logging: Never log PII (email, phone, names). Mask sensitive fields before logging.
🧱 Secure Coding Practices
- Injection Prevention: Use parameterized queries or ORMs to stop SQL, Command, and XSS injections.
- Dependency Management: Regularly scan (
audit) and update third-party libraries to patch CVEs. - Secure Auth: Implement Multi-Factor Authentication (MFA) and secure session management.
- Error Privacy: Never leak stack traces or internal implementation details to the end-user.
🔍 Continuous Security
- Shift Left: Integrate security scanners (SAST/DAST) early in the CI/CD pipeline.
- Data Minimization: Collect and store only the absolute minimum data required for the business logic.
- Logging: Maintain audit logs for sensitive operations (Auth, Deletion, Admin changes).
🚫 Anti-Patterns
- Hardcoded Secrets:
**No Secrets in Git**: Use Secret Managers or Env variables. - Raw SQL:
**No String Concatenation**: Use Parameterized queries or ORMs. - Leaking Context:
**No Stacktraces in Prod**: Return generic error codes to clients. - Insecure Defaults:
**No Default Passwords**: Force rotation and strong entropy.
📚 References
> related_skills --same-repo
> typescript-tooling
Development tools, linting, and build config for TypeScript. Use when configuring ESLint, Prettier, Jest, Vitest, tsconfig, or any TS build tooling. (triggers: tsconfig.json, .eslintrc.*, jest.config.*, package.json, eslint, prettier, jest, vitest, build, compile, lint)
> typescript-security
Secure coding practices for TypeScript. Use when validating input, handling auth tokens, sanitizing data, or managing secrets and sensitive configuration. (triggers: **/*.ts, **/*.tsx, validate, sanitize, xss, injection, auth, password, secret, token)
> typescript-language
Modern TypeScript standards for type safety and maintainability. Use when working with types, interfaces, generics, enums, unions, or tsconfig settings. (triggers: **/*.ts, **/*.tsx, tsconfig.json, type, interface, generic, enum, union, intersection, readonly, const, namespace)
> typescript-best-practices
Idiomatic TypeScript patterns for clean, maintainable code. Use when writing or refactoring TypeScript classes, functions, modules, or async logic. (triggers: **/*.ts, **/*.tsx, class, function, module, import, export, async, promise)