🇺🇸English

Security Design Patterns

Security architecture patterns and defensive coding practices for building secure applications. Covers authentication, authorization, cryptography, secrets management, input validation, rate limiting, and zero trust architecture across TypeScript/Node.js, Python, and Java.

Proactive Mode

These rules apply automatically while designing or writing code. When you detect any of the following patterns, apply the corresponding guidance immediately.

JWT Handling

When you detect JWT creation, validation, or middleware:

• Algorithm : Reject none algorithm. Prefer RS256 or ES256 over HS256 (HS256 requires shared secrets; asymmetric algorithms allow public key distribution)
• Expiry : Access tokens must expire in 15 minutes or less. Refresh tokens should use rotation (each use issues a new refresh token and invalidates the old one)
• Claims validation : Always validate iss (issuer), aud (audience), exp (expiry), iat (issued at), and nbf (not before)
• Storage : Never store JWTs in localStorage (XSS-vulnerable). Use HttpOnly cookies or in-memory with refresh token in HttpOnly cookie

Password Handling

When you detect password storage, comparison, or reset logic:

• Hashing : Use Argon2id (preferred) or bcrypt. Never SHA-256, SHA-1, MD5, or plaintext
• Salt : Must be unique per password. Argon2 and bcrypt handle this automatically
• Complexity : Follow NIST SP 800-63B: minimum 8 characters, check against breached password lists, no arbitrary composition rules
• Transmission : Always over HTTPS. Never log passwords, even hashed

CORS Configuration

When you detect CORS setup:

• Never use origin: '*' with credentials: true (browsers block this, but misconfigured proxies may not)
• Use an explicit allowlist of origins
• Restrict Access-Control-Allow-Methods to only what is needed
• Set Access-Control-Max-Age to cache preflight responses

Middleware / Interceptor Order

When you detect middleware or filter chain configuration, enforce this order:

1. Rate limiting (block abuse before any processing)
2. CORS (reject disallowed origins early)
3. Authentication (identify the caller)
4. Authorization (check permissions)
5. Input validation (validate the request body/params)
6. Business logic handler

Environment Variables and Configuration

When you detect config loading or environment variable usage:

• Verify secrets are not hardcoded in source code
• Verify .env files are in .gitignore
• Warn if secrets appear in Docker build args, CI logs, or client-side bundles
• Recommend a secret manager for production (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault)

Session Management

When you detect session or cookie configuration:

• HttpOnly : Must be true (prevents JavaScript access)
• Secure : Must be true (HTTPS only)
• SameSite : Use Strict (or Lax if cross-site GET is needed). Never None without a strong reason
• Cookie prefix : Use __Host- prefix for maximum security
• Expiry : Sessions should have absolute timeout (e.g., 24h) and idle timeout (e.g., 30min)

Authorization Checks

When you detect access control logic:

• Verify resource-level authorization, not just role checks (prevents IDOR/BOLA)
• Ensure the authenticated user owns or has explicit access to the requested resource
• In multi-tenant systems, verify tenant isolation on every query
• Authorization must happen server-side, never rely on client-side checks alone

API Key Usage

When you detect API key handling:

• Verify keys are not exposed in client-side code (frontend bundles, mobile apps)
• Keys should support rotation without downtime (accept old + new during transition)
• Hash stored API keys (they are secrets, like passwords)
• Use scoped keys with minimal permissions

File Operations with User Input

When you detect file path construction from user input:

• Reject path traversal patterns (../, ..\\, null bytes)
• Use path.resolve() and verify the result is within the allowed directory
• Never pass user input directly to fs operations or open() without sanitization

HTTP Client Calls

When you detect outgoing HTTP requests constructed with user input:

• Warn about SSRF (Server-Side Request Forgery)
• Validate and allowlist target URLs/domains
• Block requests to internal/private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254)
• Do not follow redirects blindly (redirects can target internal services)

Audit Mode

When explicitly asked to perform a security audit, evaluate the following areas and generate a report.

Audit Checklist

1. Authentication Architecture

   • Auth flows (OAuth/OIDC, session-based, API keys)
   • Token management (issuance, validation, revocation, rotation)
   • Multi-factor authentication support
   • Password policies and storage

2. Authorization Model

   • Access control type (RBAC, ABAC, ReBAC)
   • Resource-level authorization checks
   • Tenant isolation (if multi-tenant)
   • Default deny posture

3. Data Protection

   • Encryption at rest (database, file storage)
   • Encryption in transit (TLS 1.2+)
   • PII handling and minimization
   • Data retention and deletion

4. Infrastructure Patterns

   • Rate limiting on all public endpoints
   • Security headers (CSP, HSTS, etc.)
   • CORS configuration
   • TLS certificate management

5. Secrets Management

   • Storage mechanism (KMS, secret manager, env vars)
   • Rotation policy and capability
   • Access audit trail
   • No hardcoded secrets in source

6. Secure Development Lifecycle

   • Dependency scanning (SCA)
   • Static analysis (SAST)

Security Report Template

# Security Architecture Report

## Summary
Overall posture: [Strong / Needs Improvement / Critical Gaps]
Date: YYYY-MM-DD
Scope: [what was reviewed]

## Findings

### Authentication
- [rating] Description of finding
  - Current state: ...
  - Recommendation: ...

### Authorization
- [rating] Description of finding
  - Current state: ...
  - Recommendation: ...

### Data Protection
- [rating] Description of finding
  - Current state: ...
  - Recommendation: ...

### Infrastructure
- [rating] Description of finding
  - Current state: ...
  - Recommendation: ...

### Secrets Management
- [rating] Description of finding
  - Current state: ...
  - Recommendation: ...

### SDLC Security
- [rating] Description of finding
  - Current state: ...
  - Recommendation: ...

## Priority Actions
1. [Critical] ...
2. [High] ...
3. [Medium] ...

## Rating Key
- Pass: Control is properly implemented
- Warning: Partially implemented or could be improved
- Fail: Missing or critically misconfigured

Reference Files

• references/auth-patterns.md — Authentication and authorization patterns with code examples
• references/defensive-patterns.md — Input validation, rate limiting, CSRF, security headers, error handling
• references/crypto-secrets.md — Cryptography for developers and secrets management
• references/architecture.md — Zero trust, defense in depth, threat modeling, secure SDLC

Weekly Installs

1

Repository

cincinnati-asso…s/skills

First Seen

1 day ago

Security Audits

Gen Agent Trust HubPassSnykPass

Installed on

amp1

cline1

opencode1

cursor1

kimi-cli1

codex1