Agent skill · security · addyosmani
security-and-hardening
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
Why this skill is useful
Provides specific security practices and threat modeling techniques that the AI wouldn't reliably generate on its own.
What it needs
About 11k tokens when loaded. Last updated 2026-08-06. 83,053 stars on the source repository.
What this skill does
Security and Hardening Overview Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems. When to Use Building anything that accepts user input Implementing authentication or authorization Storing or transmitting sensitive data Integrating with external APIs or services Adding file uploads, webhooks, or callbacks Handling payment or PII data Process: Threat Model First Controls bolted on without a threat model are guesses. Before hardening, spend five minutes thinking like an attacker: 1. Map the trust boundaries. Where does untrusted data cross into your system? HTTP requests, form fields, file uploads, webhooks, third-party APIs, message queues, and LLM output — plus the local values that look internal because the OS handed them to you: another process's command line or environment, filenames on a shared volume, a path in a job payload. Trust follows who wrote a value, not which channel delivered it. Every boundary is attack surface. 2. Name the assets. What's worth stealing or breaking? Credentials, PII, payment data, admin actions, money movement. 3. Run STRIDE over each boundary — a quick lens, not a ceremony: Threat Ask Typical mitigation --- --- --- Spoofing Can someone impersonate a user/service? Authentication, signature verification Tampering Can data be altered in transit or at rest? Integrity checks, parameterized queries, HTTPS Repudiation Can an action be denied later? Audit logging of security events Information disclosure Can data leak? Encryption, field allowlists, generic errors Denial of service Can it be overwhelmed? Rate limiting, input size caps, timeouts Elevation of privilege Can a user gain rights they shouldn't? Authorization checks, least privilege 4. Write abuse cases next to use cases. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills addyosmani/security-and-hardening