Claude Skills by Intense-Visions

> Control request throughput with token bucket, sliding window, and fixed window algorithms to protect services from overload

> Handle transient failures with configurable retry strategies, exponential backoff, and jitter

> Prevent resource exhaustion and hung requests with timeouts, AbortController, and deadline propagation

> Autonomous batch-build orchestrator — score a batch of backlog candidates, confirm it with the human in one up-front round, fan out worktree-isolated subagents that each run the **real** per-item pipeline (brainstorming then autopilot), independently verify every result by artifact and all-OS CI, and hand back a set of merge-ready PRs for one bulk review. The fleet never auto-merges and never trusts a subagent's self-report. Building a backlog through the harness pipeline one item at a time...

> Evaluate access decisions using attributes of the subject, resource, action, and environment -- eliminating role explosion by expressing authorization as policy rules over contextual data

> Public-key cryptography for key exchange, digital signatures, and identity verification > -- Ed25519 for signatures, X25519 for key exchange, RSA-2048+ only for legacy > compatibility

> Model multi-step adversary strategies as goal-oriented tree decompositions -- revealing which attack paths are cheapest and which defenses yield the highest leverage

> Log the who, what, when, where, and outcome of every security-relevant event in a > structured, tamper-evident format that enables both real-time detection and forensic > reconstruction

> Login, registration, password reset, magic links, and SSO -- each flow has distinct attack surfaces and each must be hardened independently

> Replace ambient authority ("who are you?") with explicit capabilities ("what token do you hold?") -- eliminating confused deputy attacks by making every permission a transferable, revocable, unforgeable object

> X.509 certificates are the backbone of internet trust -- manage them correctly or accept > that attackers can impersonate any service, intercept any connection, and forge any > identity

> Run SAST, DAST, SCA, and secrets scanning on every commit -- automated security gates that > catch vulnerabilities before they reach production

> Sign every artifact you produce and verify every artifact you consume -- because an unsigned > binary could have been built by anyone, including an attacker

> Regulatory frameworks mandate specific logging requirements -- SOC2, GDPR, HIPAA, and > PCI-DSS each define what must be logged, how long logs are retained, and what constitutes > auditable evidence, and failing to meet these requirements carries fines, legal liability, > and loss of certification

> LLM-judgment critique of security posture for TS/JS source — the ceiling counterpart to `harness-security-scan` (CVE/OWASP rule-based floor) and `harness-security-reviewer` (procedural review). Threat-modeling-as-skill rather than pattern-matching. Critiques whether trust boundaries are respected, where implicit privilege escalation lurks, whether the code defends in depth or just at the gate, whether principle of least authority is honored. Sixth non-design member of the craft-pipeline ini...

> Argon2id for new systems, bcrypt for broad compatibility -- always salt, consider peppering, tune cost parameters to hardware, and plan hash upgrade paths

> Every session token, encryption key, nonce, and CSRF token depends on unpredictable randomness -- use a CSPRNG or accept that attackers will predict your secrets

> Your application is 90% third-party code -- scan it for known vulnerabilities, lock it > to exact versions, and have a strategy for when a critical CVE drops on a Friday > afternoon

> Deserialization reconstructs objects from byte streams -- and in most languages, that > reconstruction executes code, meaning an attacker who controls the serialized input controls > what code runs on your server

> Environment variables are visible in process listings, inherited by child processes, > captured in crash dumps, and logged by every debugging tool -- they are the worst place > to store secrets

> Autonomous security backlog sweep — enumerate risk-ranked code areas plus the resolved dependency tree, discard every candidate that cannot produce concrete evidence, confirm one ranked batch with the human in a single up-front round, then route each survivor by a bounded-fix test: a safe bounded fix is built through the **real** pipeline into an independently verified PR, while a risky or structural finding is filed with its evidence packet instead of force-fixed. The fleet never auto-merg...

> Digital forensics is the discipline of collecting, preserving, and analyzing evidence from > compromised systems -- done correctly, it reveals the full attack narrative; done poorly, it > destroys the evidence needed to understand what happened and prevent recurrence

> One-way functions for integrity verification, content addressing, and commitment schemes > -- SHA-256 for interoperability, BLAKE3 for performance, and never MD5 or SHA-1 for > security

> HMAC proves a message was created by someone with the shared secret; digital signatures prove it was created by a specific private key holder -- choose based on whether you need symmetric verification or non-repudiation

> Tell the browser "never connect to this domain over HTTP, ever" -- and make it permanent > by embedding the directive in every browser's shipped preload list

> Authentication at login is necessary but insufficient -- continuously evaluate identity > confidence using device trust, behavioral signals, and environmental context throughout > the session

> The first 60 minutes of a security incident determine whether the organization loses days > of data or months of data -- containment is not about fixing the vulnerability, it is about > stopping the bleeding while preserving the evidence needed to understand what happened

> Every injection vulnerability has the same root cause: untrusted data is interpreted as > code because the boundary between data and instructions was not enforced -- fix the > boundary, fix the bug

> Correlate events across multiple log sources to detect attacks that are invisible in any > single log stream -- because attackers do not confine their activities to one system

> Memory corruption vulnerabilities account for 70% of critical CVEs in C/C++ codebases -- > choose memory-safe languages by default, and when you cannot, understand the vulnerability > classes and mitigations

> Something you know, something you have, something you are -- combining authentication factors so that compromising one factor alone is insufficient to gain access

> Isolate every workload behind its own perimeter -- so compromising the web server does > not hand the attacker the database, the secrets store, and the internal APIs

> Both sides prove their identity with certificates -- the server authenticates to the > client and the client authenticates to the server, establishing a cryptographically > verified service-to-service channel

> Hire skilled attackers to find the vulnerabilities your automated tools and internal reviews > miss -- then fix what they find and verify the fixes

> Organizations that conduct blameless post-incident reviews after every significant security > incident reduce their recurrence rate by identifying systemic weaknesses; organizations that > skip the review are condemned to repeat the same failures with different symptoms

> When security depends on the order of operations but the system does not enforce that > order, attackers exploit the gap between check and use -- turning microsecond timing windows > into privilege escalation, double-spend, and data corruption

> Assign permissions to roles, assign roles to users -- simple, auditable, and sufficient for most applications when combined with resource-level checks

> Model authorization as a graph of relationships -- "User X is an editor of Document Y which belongs to Folder Z owned by Team W" -- enabling inherited permissions that follow resource hierarchies

> Know exactly what is in your software (SBOM) and prove how it was built (provenance) -- because > you cannot secure what you cannot inventory

> Secrets are born (generated), distributed (delivered to consumers), rotated (replaced on > schedule), and die (revoked and destroyed) -- manage every phase or the secret manages you

> Scale security knowledge across the engineering organization by embedding trained security > advocates in every development team -- because the security team cannot review every line of > code, but developers can

> Session tokens are bearer credentials -- generate with CSPRNG, bind to client context, enforce idle and absolute timeouts, and regenerate on privilege changes

> Find security flaws in the design document, not in the penetration test report -- because > fixing an architecture flaw costs 100x more after deployment than during design

> AES-256-GCM for most use cases, ChaCha20-Poly1305 when hardware AES is unavailable -- > always use authenticated encryption, never roll your own

> End-to-end threat modeling from system decomposition through threat enumeration, risk rating, and mitigation tracking -- the operational backbone of proactive security design

> Systematic threat identification using the six STRIDE categories -- Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege

> TLS 1.3 with ECDHE key exchange, AES-256-GCM or ChaCha20-Poly1305 ciphers, and valid > certificates -- the minimum bar for all network communication

> Every security control exists because data crosses from a trusted zone to a less-trusted one -- identify the boundaries first, then concentrate defenses there

> Centralize secrets in a vault, issue dynamic short-lived credentials, encrypt data > through a transit engine, and eliminate long-lived secrets from your infrastructure

> A vulnerability without a disclosure process is a vulnerability that gets sold to exploit > brokers, dropped as a zero-day, or posted on Twitter -- coordinated disclosure turns > discovered vulnerabilities into patches instead of breaches