Защита кода от уязвимостей по OWASP и STRIDE

★ 8.7 · security

security-and-hardening is a Claude Code skill that hardens web applications against vulnerabilities at every stage of development, from design through deployment. It mandates a threat-modeling step before any hardening work: map trust boundaries, name valuable assets, then run STRIDE analysis across each boundary to select targeted mitigations rather than guessing. The skill covers the full OWASP Top 10 prevention surface — parameterized queries against SQL injection, DOMPurify and framework auto-escaping against XSS, bcrypt/scrypt/argon2 password hashing, httpOnly/secure/sameSite cookies, CSP and HSTS headers, and resource-level authorization checks. Hard rules are explicit: never commit secrets, never log tokens, never trust client-side validation as a security boundary. A separate category of operations — new auth flows, PII storage, CORS changes — requires human approval before implementation. Ideal for teams building features that handle user input, session management, third-party integrations, or compliance with GDPR and CCPA.