When to use

This skill is always active. It applies to every project where AI agents generate code. 45% of AI-generated code has security flaws. This skill catches them before they reach production.

Critical Rules

1. Never Hardcode Secrets

Wrong:

const API_KEY = "sk-1234567890abcdef";
const dbUrl = "postgres://user:password123@localhost/db";

Correct:

const API_KEY = process.env.API_KEY;
const dbUrl = process.env.DATABASE_URL;

2. Always Validate Input

Wrong:

app.post("/api/users", (req, res) => {
  db.insert(req.body);
});

Correct:

const userSchema = z.object({ email: z.string().email(), name: z.string().min(1) });
app.post("/api/users", (req, res) => {
  const parsed = userSchema.safeParse(req.body);
  if (!parsed.success) return res.status(400).json(parsed.error.flatten());
  db.insert(parsed.data);
});

3. Enforce Authentication on Every Route

Wrong:

app.get('/api/users', (req, res) => {
  const users = await db.select('*').from('users');
  res.json(users);
});

Correct:

app.get("/api/users", authMiddleware, async (req, res) => {
  const users = await db.select("*").from("users").where("tenant_id", req.user.tenantId);
  res.json(users);
});

4. Use Row-Level Security (Supabase/Postgres)

Wrong:

const { data } = await supabase.from("profiles").select("*");

Correct:

CREATE POLICY "Users can only read own profile" ON profiles
  FOR SELECT USING (auth.uid() = id);

const { data } = await supabase.from("profiles").select("*");

5. Sanitize Database Queries

Wrong:

db.query(`SELECT * FROM users WHERE id = ${userId}`);

Correct:

db.query("SELECT * FROM users WHERE id = $1", [userId]);

6. Set CORS Properly

Wrong:

app.use(cors({ origin: "*" }));

Correct:

app.use(cors({ origin: ["https://yourdomain.com", "https://app.yourdomain.com"] }));

7. Add Rate Limiting

Wrong:

app.post("/login", loginHandler);
app.post("/signup", signupHandler);

Correct:

const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });
app.post("/login", authLimiter, loginHandler);
app.post("/signup", authLimiter, signupHandler);

8. Use HTTPS Only

Wrong:

const apiUrl = "http://api.example.com";

Correct:

const apiUrl =
  process.env.NODE_ENV === "production" ? "https://api.example.com" : "http://localhost:3000";

app.use(helmet.hsts({ maxAge: 31536000, includeSubDomains: true }));

9. Hash Passwords Properly

Wrong:

const hash = crypto.createHash("md5").update(password).digest("hex");
// or: const hash = password; (plain text)

Correct:

const hash = await bcrypt.hash(password, 12);

10. Set Security Headers

Wrong:

app.listen(3000);

Correct:

app.use(helmet());
app.use((req, res, next) => {
  res.setHeader("X-Content-Type-Options", "nosniff");
  res.setHeader("X-Frame-Options", "DENY");
  res.setHeader("Content-Security-Policy", "default-src 'self'");
  next();
});

11. Handle Errors Without Leaking Info

Wrong:

catch (err) {
  res.status(500).json({ error: err.stack, message: err.message });
}

Correct:

catch (err) {
  if (process.env.NODE_ENV === 'production') {
    res.status(500).json({ error: 'Internal server error' });
  } else {
    res.status(500).json({ error: err.message });
  }
}

12. Validate File Uploads

Wrong:

app.post("/upload", upload.single("file"), (req, res) => {
  fs.writeFileSync(`./uploads/${req.file.originalname}`, req.file.buffer);
});

Correct:

const ALLOWED_TYPES = ["image/jpeg", "image/png"];
const MAX_SIZE = 5 * 1024 * 1024;
app.post("/upload", upload.single("file"), (req, res) => {
  if (!ALLOWED_TYPES.includes(req.file.mimetype) || req.file.size > MAX_SIZE) {
    return res.status(400).json({ error: "Invalid file" });
  }
  const ext = path.extname(req.file.originalname);
  const safeName = `${uuid()}${ext}`;
  fs.writeFileSync(`./uploads/${safeName}`, req.file.buffer);
});

13. Use Environment-Specific Config

Wrong:

const config = { dbUrl: "localhost", debug: true };

Correct:

const config = {
  dbUrl: process.env.DATABASE_URL,
  debug: process.env.NODE_ENV !== "production",
};

14. Add Logging (But Not Secrets)

Wrong:

console.log("User logged in:", user);

Correct:

const { password, ...safeUser } = user;
logger.info("User logged in", { userId: safeUser.id, email: safeUser.email });

15. Set Proper Cookie Flags

Wrong:

res.cookie("session", token);
document.cookie = "session=" + token;

Correct:

res.cookie("session", token, {
  httpOnly: true,
  secure: process.env.NODE_ENV === "production",
  sameSite: "strict",
  path: "/",
  maxAge: 3600000,
});

16. Implement Proper Session Management

Wrong:

const token = jwt.sign({ userId }, secret, { expiresIn: "365d" });

Correct:

const accessToken = jwt.sign({ userId }, secret, { expiresIn: "15m" });
const refreshToken = jwt.sign({ userId }, refreshSecret, { expiresIn: "7d" });

17. Protect Against CSRF

Wrong:

app.post("/api/transfer", (req, res) => {
  transferMoney(req.body);
});

Correct:

app.use(csrf({ cookie: true }));
app.post("/api/transfer", (req, res) => {
  if (req.headers["x-csrf-token"] !== req.csrfToken()) {
    return res.status(403).json({ error: "Invalid CSRF token" });
  }
  transferMoney(req.body);
});

18. Use Content Security Policy

Wrong:

// No CSP header - inline scripts allowed

Correct:

app.use((req, res, next) => {
  res.setHeader(
    "Content-Security-Policy",
    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'",
  );
  next();
});

19. Validate Redirects

Wrong:

res.redirect(req.query.next || "/");

Correct:

const ALLOWED_REDIRECTS = ["/dashboard", "/profile", "/settings"];
const next = req.query.next;
const target = ALLOWED_REDIRECTS.includes(next) ? next : "/";
res.redirect(target);

20. Check Dependencies for Vulnerabilities

Wrong:

// Never running npm audit

Correct:

npm audit
npm audit fix

# In CI: .github/workflows/ci.yml
- run: npm audit --audit-level=high