All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,105
- 1,297
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 14,689–14,712 of 31,105 skills
- MinimalFind actual weaknesses in a built or running system, then triage them by real-world risk so the small number that matter get fixed first.Votes: 0GitHub stars: 2
- VerboseEvery methodology — STRIDE, PASTA, LINDDUN, attack trees — is a technique for answering four questions in order:Votes: 0GitHub stars: 2
- MinimalA structured pass over a design — diagram, trust boundaries, STRIDE, mitigations — that finds whole classes of flaws while they are still cheap to fix.Votes: 0GitHub stars: 2
- VerboseThreat identification fails when it starts from an architecture diagram, because diagrams show components and attackers pursue assets. Build the asset register first and rate each on confidentiality, integrity, and availability separately.Votes: 0GitHub stars: 2
- MinimalEnumerate what could go wrong in a system before deciding what to do about it — inventory the assets worth attacking, the entry points that reach them, and the actors who would try.Votes: 0GitHub stars: 2
- VerboseEvery category of tool has a blind spot that follows from its mechanism, not from its quality. Buying a better product in the same category does not close it.Votes: 0GitHub stars: 2
- MinimalChoose and place automated security tools so each covers a class of defect the others structurally cannot, without drowning the pipeline in false positives.Votes: 0GitHub stars: 2
- VerboseYou cannot review what you cannot see. Before any judgment, produce four artifacts:Votes: 0GitHub stars: 2
- MinimalEvaluate a system's design — its trust boundaries, data flows, and blast radius — to find flaws that no amount of correct code at the line level can fix.Votes: 0GitHub stars: 2
- VerboseEvery review starts the same way: enumerate the sources of attacker-controlled data, enumerate the dangerous sinks, and ask whether anything sanitizing sits between them.Votes: 0GitHub stars: 2
- MinimalRead code as an attacker would, at the line level, and find the flaws scanners structurally cannot see — missing authorization, broken business logic, misused crypto.Votes: 0GitHub stars: 2
- VerboseAlmost every object-storage mistake comes from carrying filesystem instincts into a system that only superficially resembles one. Object storage (S3, GCS, Azure Blob) is a flat map from a string key to an immutable blob of bytes, reached over HTTP. That is the whole model. What looks like a directory tree is an illusion the tooling paints over a flat namespace.Votes: 0GitHub stars: 2
- VerboseCryptography rarely fails at the primitive — it fails at the seams, in how the pieces are wired together. Name the property you need, then pick the primitive that provides exactly that.Votes: 0GitHub stars: 2
- MinimalChoose the right cryptographic primitive for a job, and use it with the parameters that make it safe. Never design your own.Votes: 0GitHub stars: 2
- MinimalReduce what a container can do and what it contains, so that code execution inside it yields as little as possible.Votes: 0GitHub stars: 2
- VerboseScope is the first and most consequential decision in an assessment. It determines which systems an auditor examines, how much evidence you must produce, and how long remediation takes. Get it wrong in either direction and the assessment fails: too narrow and it collapses when the auditor traces a data flow you excluded; too broad and you spend a year evidencing systems that never touch regulated data.Votes: 0GitHub stars: 2
- MinimalLay out VPCs, subnets, routing, and private connectivity so traffic reaches only what it should — without paying a fortune to cross an availability-zone boundary.Votes: 0GitHub stars: 2
- VerboseAuthentication starts with never holding the secret you are checking. Store a verifier — a slow, salted hash — not the password.Votes: 0GitHub stars: 2
- MinimalDesign authentication that proves who a user is, without leaking credentials or sessions.Votes: 0GitHub stars: 2
- VerboseAn API has no UI to hide things behind. Every identifier a client has ever seen is an identifier it can replay against every endpoint. The dominant API vulnerability class — broken object-level authorization — is not a missing authentication check; the attacker is fully authenticated as themselves.Votes: 0GitHub stars: 2
- MinimalIdentify and close the failure modes specific to APIs — where the caller is a program, every endpoint is directly reachable, and the UI enforces nothing.Votes: 0GitHub stars: 2
- MinimalConcrete configuration that shrinks an API's attack surface at the edge and in the runtime — transport, CORS, limits, headers, and egress.Votes: 0GitHub stars: 2
- Threat ModelingEvery methodology — STRIDE, PASTA, LINDDUN, attack trees — is a technique forVotes: 0GitHub stars: 2
- Object Storage PatternsAlmost every object-storage mistake comes from carrying filesystem instincts intoVotes: 0GitHub stars: 2