Installs into .claude/skills of the current project.
Are you the author of Security Kprsnt2?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/diegosouzapw-security-kprsnt2)
---
name: security
description: Application security best practices including OWASP Top 10, authentication, and data protection.
globs: ["**/*.js", "**/*.ts", "**/*.py", "**/*.java", "**/*.go"]
alwaysApply: ["**/SECURITY.md"]
priority: 100
tags: ["security"]
---
# Application Security Best Practices
## Input Validation
- Validate all user input
- Use allowlisting over blocklisting
- Sanitize HTML to prevent XSS
- Use parameterized queries for SQL
- Validate file uploads (type, size)
## Authentication
- Use strong password hashing (bcrypt, argon2)
- Implement MFA where possible
- Use secure session management
- Implement rate limiting on auth endpoints
- Use JWTs properly (short expiry, refresh tokens)
## Authorization
- Implement least privilege
- Check authorization on every request
- Use role-based access control
- Implement row-level security
- Audit access to sensitive data
## Data Protection
- Encrypt sensitive data at rest
- Use TLS for data in transit
- Don't log sensitive data
- Implement proper key management
- Use secure cookie flags
## Common Vulnerabilities (OWASP Top 10)
- Injection: Use prepared statements
- Broken Auth: Secure session handling
- XSS: Sanitize output, use CSP
- CSRF: Use anti-CSRF tokens
- Security Misconfiguration: Review defaults
- Sensitive Data Exposure: Encrypt everything
- Broken Access Control: Check on server
- SSRF: Validate URLs, use allowlists
## Dependencies
- Keep dependencies updated
- Use npm audit/pip audit
- Pin dependency versions
- Use lockfiles
- Monitor for vulnerabilities
