devs:security-core

Security Core

Comprehensive application security guidance for TypeScript, Python, and Rust applications.

Quick Start

Common Security Tasks

Setting up authentication:

1. Generate JWT keys: ./​scripts/​generate_jwt_keys.sh RS256
2. Consult authentication.md for implementation patterns
3. Use security templates from assets/​configs/

Implementing authorization:

1. Review authorization.md for RBAC/​ABAC/​RLS patterns
2. For Supabase: See RLS section with multi-tenant examples
3. Implement permission checking at API and database layers

Security auditing:

1. Run: ./​scripts/​audit_security.sh
2. Review code-review.md checklist
3. Check owasp-top-10.md for vulnerabilities

Hardening application:

1. Apply security headers from security-headers.md
2. Implement rate limiting from rate-limiting.md
3. Configure secrets management per secrets-management.md

When to Use This Skill

Authentication Scenarios

• Implementing login/​signup flows
• Adding JWT or session-based authentication
• Integrating OAuth 2.0 providers
• OAuth for CLI, TUI, or desktop applications (Device Flow)
• Multi-factor authentication (TOTP, SMS/​Email OTP)
• Password hashing and validation

Authorization Scenarios

• Role-Based Access Control (RBAC)
• Attribute-Based Access Control (ABAC)
• Row Level Security (RLS) with Supabase/​PostgreSQL
• Multi-tenant data isolation
• Permission-based access control
• Resource ownership validation

Security Auditing

• Code security reviews
• Dependency vulnerability scanning
• OWASP Top 10 compliance checks
• Secret detection in code
• Security configuration verification

Infrastructure Security

• Security headers (CSP, HSTS, X-Frame-Options)
• CORS configuration
• Rate limiting implementation
• Secrets management
• API security hardening

Core Resources

Scripts (scripts/)

audit_security.sh - Security audit for TypeScript, Python, and Rust projects

• Runs dependency vulnerability scanners (npm audit, pip-audit, cargo-audit)
• Detects hardcoded secrets in code
• Checks for common security misconfigurations
• Usage: ./​scripts/​audit_security.sh [project-directory]

generate_jwt_keys.sh - Generate secure JWT signing keys

• Supports HS256 (symmetric), RS256 (asymmetric), ES256 (elliptic curve)
• Automatically adds keys to .gitignore
• Provides usage examples
• Usage: ./​scripts/​generate_jwt_keys.sh [ALGORITHM] [OUTPUT_DIR]

Reference Documentation (references/)

authentication.md - Complete authentication guide

• JWT implementation (TypeScript, Python, Rust)
• Session-based authentication
• OAuth 2.0 Authorization Code Flow
• OAuth Device Flow for CLI/​TUI/​desktop apps ⭐
• Multi-factor authentication (TOTP, SMS)
• Password security and hashing
• Token storage best practices

authorization.md - Authorization patterns and implementations

• Role-Based Access Control (RBAC)
• Attribute-Based Access Control (ABAC)
• Row Level Security (RLS) with Supabase/​PostgreSQL ⭐
• Multi-tenant RLS patterns
• Permission checking patterns
• Resource-based authorization
• Testing authorization logic

owasp-top-10.md - OWASP Top 10 prevention guide

• A01: Broken Access Control
• A02: Cryptographic Failures
• A03: Injection (SQL, NoSQL, Command)
• A04: Insecure Design
• A05: Security Misconfiguration
• A06: Vulnerable Components
• A07: Authentication Failures
• A08: Data Integrity Failures
• A09: Logging & Monitoring Failures
• A10: Server-Side Request Forgery (SSRF)

secrets-management.md - Secrets and credentials management

• Environment variables best practices
• Secret managers (AWS Secrets Manager, HashiCorp Vault)
• Secret rotation strategies
• CI/​CD secrets handling
• Local development with .env files

security-headers.md - HTTP security headers

• Content-Security-Policy (CSP)
• Strict-Transport-Security (HSTS)
• X-Frame-Options, X-Content-Type-Options
• CORS configuration
• Implementation examples for all frameworks

rate-limiting.md - Rate limiting strategies

• Fixed window, sliding window, token bucket
• Implementation in TypeScript, Python, Rust
• Distributed rate limiting with Redis
• Per-user and per-IP limiting
• Rate limit headers and responses

code-review.md - Security code review checklist

• Authentication & authorization checks
• Input validation & sanitization
• Data protection and encryption
• Security headers & configuration
• Session management
• API security
• Common vulnerabilities (XSS, CSRF, SQL injection)

Configuration Templates (assets/​configs/)

Ready-to-use security middleware for all supported languages:

TypeScript: assets/​configs/​typescript/​security-config.ts

• Express + Helmet configuration
• CORS setup
• Rate limiting
• Security headers

Python: assets/​configs/​python/​security_middleware.py

• FastAPI middleware
• Security headers
• CORS
• Rate limiting with slowapi

Rust: assets/​configs/​rust/​security_middleware.rs

• Axum middleware
• tower-http CORS layer
• Security headers

Decision Guides

Choosing Authentication Method

See authentication.md for detailed implementation patterns.

Choosing Authorization Model

See authorization.md for implementation patterns and RLS examples.

OAuth for CLI/​TUI/​Desktop

For applications without traditional browser redirects:

Device Authorization Flow (OAuth 2.0):

1. App requests device code
2. User opens browser and enters code
3. App polls for token
4. Token granted after user approval

Full implementation examples in authentication.md - OAuth for CLI, TUI, and Desktop Apps.

Common Workflows

1. Implementing JWT Authentication

# Generate keys
./​scripts/​generate_jwt_keys.sh RS256 ./​keys

# Review implementation patterns
# See references/​authentication.md#jwt-authentication

Then implement using examples for your language (TypeScript/​Python/​Rust).

2. Adding Row Level Security (Supabase)

# Review RLS patterns
# See references/​authorization.md#row-level-security-rls

Implement RLS policies for multi-tenant isolation:

• Enable RLS on tables
• Create policies for SELECT, INSERT, UPDATE, DELETE
• Use helper functions for complex rules
• Test with different user contexts

3. Security Audit Workflow

# Run automated audit
./​scripts/​audit_security.sh

# Manual review
# 1. Check references/​code-review.md checklist
# 2. Review references/​owasp-top-10.md for vulnerabilities
# 3. Verify security headers with references/​security-headers.md
# 4. Test rate limiting per references/​rate-limiting.md

4. Hardening New Application

1. Apply security templates:

   • Copy appropriate config from assets/​configs/[language]/
   • Configure CORS for your domains
   • Set up rate limiting

2. Implement authentication:

   • Choose method from authentication.md
   • Generate secure keys
   • Configure token expiration

3. Add authorization:

   • Choose model from authorization.md
   • Implement permission checks
   • Enable RLS if multi-tenant

4. Configure security headers:

   • Follow security-headers.md
   • Test with online tools

5. Set up secrets management:

   • Follow secrets-management.md
   • Use environment variables or secret manager

6. Review OWASP Top 10:

   • Check owasp-top-10.md
   • Ensure all risks are mitigated

Language-Specific Guidance

TypeScript/​Node.js

• Use Helmet for security headers
• Validate inputs with Zod
• Use prepared statements for SQL
• Hash passwords with bcrypt
• See config: assets/​configs/​typescript/​security-config.ts

Python/​FastAPI

• Use Pydantic for validation
• Parameterized queries only
• Hash passwords with bcrypt
• Security middleware in startup
• See config: assets/​configs/​python/​security_middleware.py

Rust

• Compiler prevents many issues
• Validate at boundaries
• Use sqlx for type-safe SQL
• Hash passwords with argon2
• See config: assets/​configs/​rust/​security_middleware.rs

Best Practices

1. Defense in Depth - Multiple security layers
2. Least Privilege - Grant minimum necessary permissions
3. Fail Securely - Default to deny
4. Keep Secrets Secret - Never commit credentials
5. Validate Everything - All inputs at boundaries
6. Use Strong Crypto - Modern algorithms only
7. Log Security Events - Authentication, authorization failures
8. Update Dependencies - Regular security patches
9. Rate Limit - Protect against abuse
10. Test Security - Automated security tests

Testing Security

Write tests for security concerns:

// Authentication tests
it('should reject invalid credentials');
it('should rate limit login attempts');
it('should require MFA when enabled');

// Authorization tests
it('should deny unauthorized access');
it('should allow access for correct role');
it('should enforce resource ownership');

// Input validation tests
it('should prevent SQL injection');
it('should sanitize HTML input');
it('should validate file uploads');

See code-review.md for complete testing checklist.

Security Resources

Primary references in this skill:

• authentication.md - Auth patterns and OAuth for CLI/​desktop
• authorization.md - RBAC, ABAC, and RLS
• owasp-top-10.md - Top web vulnerabilities
• secrets-management.md - Credential handling
• security-headers.md - HTTP security headers
• rate-limiting.md - API protection
• code-review.md - Security review checklist

External resources:

• OWASP Top 10
• OWASP Cheat Sheet Series
• Security Headers
• Mozilla Web Security Guidelines

Getting Started

For a new secure application:

1. Review Best Practices section
2. Apply security templates from assets/​configs/
3. Implement authentication from authentication.md
4. Add authorization from authorization.md
5. Configure security headers from security-headers.md
6. Run ./​scripts/​audit_security.sh to verify

For security review:

1. Run ./​scripts/​audit_security.sh
2. Follow code-review.md checklist
3. Check owasp-top-10.md for vulnerabilities

For specific security concern:

• Authentication issue → authentication.md
• Authorization issue → authorization.md
• OWASP vulnerability → owasp-top-10.md
• Configuration issue → security-headers.md or rate-limiting.md
• Secrets issue → secrets-management.md