All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 32,019
- 1,335
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 13,585–13,608 of 32,019 skills
- Security Credential Storage> Argon2id for new systems, bcrypt for broad compatibility -- always salt, consider peppering, tune cost parameters to hardware, and plan hash upgrade pathsVotes: 0GitHub stars: 20
- Security Ci Security Testing> Run SAST, DAST, SCA, and secrets scanning on every commit -- automated security gates that > catch vulnerabilities before they reach productionVotes: 0GitHub stars: 20
- Security Capability Based Security> Replace ambient authority ("who are you?") with explicit capabilities ("what token do you hold?") -- eliminating confused deputy attacks by making every permission a transferable, revocable, unforgeable objectVotes: 0GitHub stars: 20
- Security Authentication Flows> Login, registration, password reset, magic links, and SSO -- each flow has distinct attack surfaces and each must be hardened independentlyVotes: 0GitHub stars: 20
- Security Audit Log Design> Log the who, what, when, where, and outcome of every security-relevant event in a > structured, tamper-evident format that enables both real-time detection and forensic > reconstructionVotes: 0GitHub stars: 20
- Security Attack Trees> Model multi-step adversary strategies as goal-oriented tree decompositions -- revealing which attack paths are cheapest and which defenses yield the highest leverageVotes: 0GitHub stars: 20
- Security Asymmetric Encryption> Public-key cryptography for key exchange, digital signatures, and identity verification > -- Ed25519 for signatures, X25519 for key exchange, RSA-2048+ only for legacy > compatibilityVotes: 0GitHub stars: 20
- Owasp Security Headers> Configure HTTP security headers to protect against XSS, clickjacking, MIME sniffing, and information leakageVotes: 0GitHub stars: 20
- Owasp Logging Monitoring> Implement security logging and monitoring to detect attacks, support incident response, and maintain audit trailsVotes: 0GitHub stars: 20
- Owasp Idor Prevention> Enforce object-level authorization so users can only access resources they own or are permitted to accessVotes: 0GitHub stars: 20
- Owasp Dependency Security> Manage third-party dependency risks with auditing, lockfiles, automated scanning, and supply chain hardeningVotes: 0GitHub stars: 20
- Owasp Csrf Protection> Prevent cross-site request forgery by validating request origin and requiring unpredictable tokens for state-changing operationsVotes: 0GitHub stars: 20
- Owasp Cryptography> Apply cryptographic best practices for password hashing, data encryption, digital signing, and key managementVotes: 0GitHub stars: 20
- Owasp Auth Patterns> Implement authentication that resists credential stuffing, session hijacking, and token theftVotes: 0GitHub stars: 20
- Node Crypto Patterns> Implement hashing, HMAC, signing, encryption, and key derivation with Node.js cryptoVotes: 0GitHub stars: 20
- Nestjs Guards Pattern> Protect routes with @UseGuards, CanActivate, JWT guards, and role-based access controlVotes: 0GitHub stars: 20
- Harness Supply Chain Audit> 6-factor dependency risk evaluation adapted from Trail of Bits security skill patterns. Surfaces dependency risk flags for human review — not automated verdicts.Votes: 0GitHub stars: 20
- Harness Security Scan> Lightweight mechanical security scan. Fast triage, not deep review.Votes: 0GitHub stars: 20
- Harness Security Review> Deep security audit combining mechanical scanning with AI-powered vulnerability analysis. OWASP baseline + stack-adaptive rules + optional threat modeling.Votes: 0GitHub stars: 20
- Harness Secrets> Secret detection, credential hygiene, and vault integration. Find exposed secrets, classify risk, and enforce externalization before they reach production.Votes: 0GitHub stars: 20
- Harness Auth> OAuth2, JWT, RBAC/ABAC, session management, and MFA pattern analysis. Detects authentication and authorization mechanisms, evaluates security posture against OWASP guidelines, and recommends improvements for token lifecycle, permission models, and multi-factor authentication.Votes: 0GitHub stars: 20
- Graphql Auth Patterns> Implement authentication and authorization in GraphQL with context-based identity, directives, and field-level guardsVotes: 0GitHub stars: 20
- Api Webhook Security> WEBHOOK SECURITY IS A RECEIVER-SIDE RESPONSIBILITY — SIGNATURE VERIFICATION, TIMESTAMP VALIDATION, AND SECRET ROTATION ARE THE THREE CONTROLS THAT PREVENT SPOOFED DELIVERIES, REPLAY ATTACKS, AND CREDENTIAL EXPOSURE, AND OMITTING ANY ONE OF THEM CREATES AN EXPLOITABLE GAP EVEN IF THE OTHER TWO ARE CORRECTLY IMPLEMENTED.Votes: 0GitHub stars: 20
- Api Oauth2 Flows> OAUTH2 FLOW SELECTION IS DETERMINED BY CLIENT TYPE AND DEPLOYMENT ENVIRONMENT — AUTHORIZATION CODE + PKCE FOR USER-FACING APPS, CLIENT CREDENTIALS FOR MACHINE-TO-MACHINE, DEVICE CODE FOR BROWSERLESS CLIENTS — USING THE WRONG FLOW INTRODUCES CREDENTIAL EXPOSURE VECTORS THAT THE CORRECT FLOW ARCHITECTURALLY ELIMINATES.Votes: 0GitHub stars: 20