Secure

Security

This skill is for securing your app's code and data. For regulatory compliance (HIPAA, SOC 2, GDPR), use compliance. For pre-launch readiness checks, use go-live. For environment variable setup during deployment, use deploy. For database-level security (Row Level Security), use database.

Don't Do Yet

• Don't implement OAuth/SSO until you have paying customers who need it. Email + password is fine for launch.
• Don't buy a pentest until you have 1,000+ users or handle sensitive data (health, finance). This checklist is enough for MVP.
• Don't set up a Web Application Firewall (WAF) — your hosting platform (Vercel, Railway) handles this. You don't need Cloudflare yet.
• Don't build your own auth system. Use Supabase Auth, Clerk, or NextAuth. Rolling your own is how breaches happen.

Quick Start

Claude Code:

Run a security audit on my app. Check for:
- API keys or secrets in code (should be in .env)
- Missing auth on protected routes
- SQL injection risks
- XSS vulnerabilities
- Missing rate limiting
Fix anything you find.

Lovable / Replit / Cursor (paste into chat):

Review my app for security issues. Check these common problems:
1. Are any API keys or passwords hardcoded? Move them to environment variables.
2. Can someone access pages without logging in? Add auth checks.
3. Is user input validated before hitting the database?
4. Are passwords hashed (not stored as plain text)?
5. Is rate limiting set up on API endpoints?
Show me what needs fixing and fix it.

---

Security Checklist

Security Basics:
- [ ] Authentication required for protected routes
- [ ] Passwords hashed (bcrypt/argon2), never stored plain text
- [ ] API keys in environment variables, not code
- [ ] HTTPS only in production
- [ ] Input validated on server side
- [ ] SQL injection prevented (use parameterized queries)
- [ ] XSS prevented (sanitize user input)
- [ ] CSRF tokens on forms
- [ ] Rate limiting on API endpoints
- [ ] User sessions expire (30min-1hr typical)

See COMMON-VULNS.md for detailed checks.

---

Critical: Never Store These in Code

Move to environment variables:

• Database passwords
• API keys (Stripe, SendGrid, etc)
• JWT secrets
• OAuth client secrets
• Encryption keys

Tell AI:

Store API keys in .env file, not in code.
Add .env to .gitignore.
Access via process.env.API_KEY

---

Authentication

Use a service. Don't build this yourself.

If you must build auth yourself (not recommended), the minimums are:

• Passwords: 8+ chars, hashed with bcrypt (12 rounds), never stored plain text
• Email verification required for signups
• Password reset via email token only
• Sessions expire after 30-60 minutes idle

Tell AI:

Set up authentication using [Supabase Auth / NextAuth / Clerk].
I need: email+password signup, email verification, password reset,
and session timeout after 30 minutes of inactivity.

See SECURITY-PROMPTS.md for implementation details.

---

Data Protection

Always encrypt:

• Passwords (hashed, not encrypted)
• Payment info (use Stripe, don't store cards)
• Personal identifiable information (PII)

Never log:

• Passwords (even hashed)
• Credit card numbers
• API keys
• Session tokens

Tell AI:

Never log sensitive data.
Replace passwords/tokens with "[REDACTED]" in logs.

---

API Security

Required for all API endpoints:

• Authentication check
• Rate limiting (prevent abuse)
• Input validation
• Error messages don't leak info

Tell AI:

Add to all API routes:
- Require valid auth token
- Rate limit: 100 requests/minute per IP
- Validate all inputs (reject invalid)
- Generic error messages (no stack traces to users)

---

Common Vulnerabilities

Most common in AI-built apps:

1. Exposed API keys - In code instead of .env 2. No rate limiting - APIs can be spammed 3. Missing auth checks - Routes accessible without login 4. SQL injection - Raw SQL with user input 5. XSS attacks - Unescaped user content displayed

See COMMON-VULNS.md for how to check.

---

Security Prompts for AI

Adding authentication:

Add authentication to this route.
Require valid JWT token.
Return 401 if missing/invalid.
Don't expose error details.

Rate limiting:

Add rate limiting:
- 100 requests/minute per IP
- Return 429 "Too many requests" if exceeded
- Use sliding window, not fixed

Input validation:

Validate all user inputs:
- Email: valid format
- Password: 8+ chars, 1 number, 1 symbol
- Username: alphanumeric only, 3-20 chars
Reject invalid input with clear error message

See SECURITY-PROMPTS.md for more.

---

Pre-Launch Security Review

Before deploying:

Production Security:
- [ ] All secrets in environment variables
- [ ] HTTPS enforced (no HTTP)
- [ ] Database backups configured
- [ ] Rate limiting on all APIs
- [ ] Error pages don't show stack traces
- [ ] Admin routes protected
- [ ] File uploads validated (type, size)
- [ ] CORS configured (not wildcard "*")

---

When to Get Security Audit

Signs you need expert review:

• Handling payments directly (not Stripe)
• Storing health/financial data
• Multi-tenant with data isolation
• Over 1,000 users
• Processing sensitive PII

For most MVPs: Following this checklist is sufficient.

---

Common Founder Mistakes

---

Quick Wins

Easy security improvements:

1. Add Helmet.js (Node) - Sets security headers 2. Use HTTPS everywhere - Force in production 3. Add rate limiting - Prevents abuse 4. Environment variables - Keep secrets safe 5. Update dependencies - Fix known vulnerabilities

Tell AI:

Add helmet.js for security headers.
Configure for production (HTTPS, CSP, XSS protection).

---

Testing Security

Quick checks:

Exposed secrets:

grep -r "api_key" src/
grep -r "password" src/
# Should only find references to env vars

No auth bypass:

• Try accessing protected routes without login
• Should redirect to login or return 401

Rate limiting works:

• Hit API endpoint 100 times quickly
• Should get 429 error

---

Success Looks Like

✅ No secrets in code (all in .env) ✅ Can't access protected routes without auth ✅ Passwords hashed, never stored plain text ✅ Rate limiting prevents abuse ✅ HTTPS enforced in production ✅ Input validated on server side

---

Related Skills

• compliance — Regulatory requirements (HIPAA, SOC 2, GDPR, CCPA)
• go-live — Pre-launch readiness checks (security is one part of this)
• deploy — Hosting and environment variable setup
• database — Row Level Security, data access policies
• payments — Stripe security and PCI compliance

Common Vulnerabilities

Quick reference for checking security issues in AI-built apps.

---

OWASP Top 10 (Simplified)

1. Broken Access Control

What: Users can access things they shouldn't

Check:

• Can logged-out users access protected pages?
• Can User A see User B's data?
• Can regular users access admin functions?

Fix with AI:

Add authorization check:
Verify user owns this resource before allowing access.
Return 403 if user doesn't have permission.

---

2. Cryptographic Failures

What: Weak encryption or exposed sensitive data

Check:

• Are passwords hashed (not encrypted)?
• Is HTTPS forced in production?
• Are API keys in .env (not code)?

Fix with AI:

Hash passwords with bcrypt (12 rounds).
Never store plain text passwords.
Force HTTPS in production.

---

3. Injection (SQL, NoSQL, Command)

What: User input executed as code

Check:

• Are you using raw SQL with user input?
• Are you using string concatenation for queries?

Fix with AI:

Use parameterized queries only.
Never concatenate user input into SQL.
Example: db.query('SELECT * FROM users WHERE id = ?', [userId])

---

4. Insecure Design

What: Missing security features from design

Check:

• Is there rate limiting on APIs?
• Do sessions expire?
• Is there brute force protection on login?

Fix with AI:

Add rate limiting: 100 req/min per IP.
Add login attempt limit: 5 tries, then 15min lockout.
Sessions expire after 30min idle.

---

5. Security Misconfiguration

What: Insecure defaults, unnecessary features enabled

Check:

• Are error messages showing stack traces?
• Is CORS set to wildcard "*"?
• Are default passwords still in use?

Fix with AI:

Production error handling:
- Log full errors server-side
- Show generic message to users ("Something went wrong")
- Never expose stack traces

Configure CORS to whitelist only:
- https://yourapp.com
- https://www.yourapp.com

---

6. Vulnerable Components

What: Using outdated libraries with known vulnerabilities

Check:

npm audit
# or
yarn audit

Fix with AI:

Update all dependencies to latest stable versions.
Fix vulnerabilities shown in npm audit.

---

7. Authentication Failures

What: Weak or broken authentication

Check:

• Can users use weak passwords?
• Is there multi-login prevention?
• Do sessions timeout?

Fix with AI:

Enforce password requirements:
- 8+ characters
- 1 uppercase, 1 lowercase
- 1 number, 1 symbol

Add session management:
- Expire after 30min idle
- Invalidate on password change
- Require re-auth for sensitive actions

---

8. Software/Data Integrity Failures

What: Code/data modified without verification

Check:

• Are dependencies verified (package-lock.json)?
• Is there backup/restore for data?

Fix with AI:

Commit package-lock.json to git.
Configure automated daily database backups.
Test restore process.

---

9. Logging Failures

What: Not logging security events or logging sensitive data

Check:

• Are failed logins logged?
• Are API errors logged?
• Are passwords being logged?

Fix with AI:

Log security events:
- Failed login attempts (with IP, timestamp)
- API authentication failures
- Permission denied events

Never log:
- Passwords (even hashed)
- API keys
- Session tokens
- Credit card numbers

---

10. Server-Side Request Forgery (SSRF)

What: Server makes requests to unintended locations

Check:

• Does your app fetch user-provided URLs?
• Can users trigger requests to internal IPs?

Fix with AI:

Validate URLs before fetching:
- Whitelist allowed domains only
- Block private IP ranges (192.168.*, 10.*, 127.*)
- Timeout requests (5 seconds max)

---

Quick Vulnerability Scan

Run these checks:

1. Secrets exposed:

grep -r "api_key\|API_KEY" src/
grep -r "password\|PASSWORD" src/
# Should only find env var references

2. Authentication:

curl http://localhost:3000/api/admin
# Should return 401, not data

3. Rate limiting:

for i in {1..150}; do curl http://localhost:3000/api/endpoint; done
# Should start returning 429

4. HTTPS:

curl http://yourapp.com
# Should redirect to https://

---

Platform-Specific Issues

Vercel/Netlify

• Environment variables set in dashboard
• HTTPS automatic
• Watch for exposed API routes

Replit

• Secrets in "Secrets" panel, not .env
• Public by default (careful with data)
• Use authentication on all routes

Lovable

• Check what environment variables it needs
• Verify authentication on generated routes
• Test rate limiting manually

---

When to Worry

Low risk (handle with checklist):

• Basic CRUD app
• < 100 users
• No payment processing
• No sensitive PII

Medium risk (get review):

• Using Stripe/payment processing
• 100-1000 users
• Basic PII (names, emails)
• User-generated content

High risk (hire expert):

• Direct payment handling
• Health/financial data
• > 1000 users
• Multi-tenant with isolation
• Regulatory requirements (HIPAA, SOC2)

---

Emergency Response

If you discover a vulnerability:

1. Assess severity: Can it be exploited now? 2. Hotfix immediately: Disable feature or add auth 3. Fix properly: Work with AI to implement correct solution 4. Notify users: If data exposed, be transparent 5. Document: What happened, how fixed, prevention

Quick hotfix pattern:

Temporarily disable this endpoint.
Return 503 "Under maintenance" for now.
We'll fix properly and re-enable.

Security Prompts for AI

How to ask AI tools to implement security features correctly.

---

Authentication

Add Basic Auth

Implement authentication:
- bcrypt password hashing (12 rounds)
- JWT tokens (expire in 1 hour)
- Refresh tokens (expire in 7 days)
- Email verification required
- Password reset via email

Password requirements:
- 8+ characters
- 1 uppercase, 1 lowercase
- 1 number, 1 symbol

Protect Routes

Add authentication middleware to these routes:
- /api/dashboard
- /api/settings
- /api/admin/*

Return 401 if no valid token.
Include WWW-Authenticate header.

Session Management

Implement session management:
- Expire after 30 minutes idle
- Extend on activity
- Invalidate on logout
- Invalidate all sessions on password change
- Store in Redis with TTL

---

Data Protection

Environment Variables

Move these to environment variables:
- DATABASE_URL
- JWT_SECRET
- STRIPE_API_KEY
- SENDGRID_API_KEY

Access via process.env.VARIABLE_NAME
Add .env.example with dummy values
Add .env to .gitignore

Hash Passwords

Update password handling:
- Hash with bcrypt (12 rounds minimum)
- Never store plain text
- Never log password (even hashed)
- Verify password: bcrypt.compare(input, stored)

Sanitize Input

Sanitize user input before storing:
- Strip HTML tags (except allowed: <p>, <b>, <i>)
- Escape special characters
- Limit length: 500 chars for bio, 100 for name
- Reject scripts and dangerous content

---

API Security

Rate Limiting

Add rate limiting to all API routes:
- 100 requests/minute per IP
- 1000 requests/hour per user
- Return 429 with Retry-After header
- Use sliding window (not fixed)
- Whitelist: health check endpoint

Input Validation

Validate API inputs:
- Email: valid format, max 255 chars
- Password: meets requirements
- Username: alphanumeric + underscore, 3-20 chars
- URLs: valid format, https only

Return 400 with specific field errors.

Error Handling

Production error handling:
- Catch all errors
- Log full details server-side
- Return generic message: "An error occurred"
- Never expose: stack traces, DB errors, file paths
- Include error ID for support requests

---

Database Security

Prevent SQL Injection

Update database queries:
- Use parameterized queries ONLY
- Never concatenate user input into SQL
- Use ORM query builders (Prisma, TypeORM)

Example:
db.query('SELECT * FROM users WHERE id = ?', [userId])
NOT: db.query(`SELECT * FROM users WHERE id = ${userId}`)

Connection Security

Secure database connection:
- Use SSL/TLS
- Minimum TLS 1.2
- Store connection string in .env
- Use connection pooling
- Set timeout: 30 seconds

---

File Upload Security

Validate Uploads

Secure file uploads:
- Whitelist types: jpeg, png, pdf only
- Max size: 5MB
- Scan filenames: no path traversal (../)
- Generate random filenames (UUID)
- Store outside web root
- Serve via CDN (not direct)

Image Processing

Process uploaded images:
- Strip EXIF data
- Re-encode to remove malicious content
- Resize to max dimensions (2048x2048)
- Convert to safe format (jpeg/png)

---

CORS Configuration

Production CORS

Configure CORS:
- Whitelist exact origins:
  - https://yourapp.com
  - https://www.yourapp.com
- Allow credentials: true
- Allowed methods: GET, POST, PUT, DELETE
- Allowed headers: Content-Type, Authorization
- Max age: 3600

NOT: origin: "*" (never use wildcard in production)

---

Headers & HTTPS

Security Headers

Add security headers (use helmet.js):
- Strict-Transport-Security: max-age=31536000
- X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
- X-XSS-Protection: 1; mode=block
- Content-Security-Policy: [your policy]
- Referrer-Policy: strict-origin-when-cross-origin

Force HTTPS

Enforce HTTPS in production:
- Redirect HTTP to HTTPS
- Set Secure flag on cookies
- Use HSTS header
- No mixed content (all resources via HTTPS)

---

Logging & Monitoring

Security Event Logging

Log security events:
- Failed login attempts (IP, timestamp, username)
- Successful logins (IP, timestamp)
- Password changes
- Permission denied (403)
- Rate limit hits (429)
- Invalid tokens

Format: JSON with timestamp, event_type, user_id, IP, details

Sensitive Data Redaction

Redact sensitive data in logs:
- Replace passwords with "[REDACTED]"
- Truncate tokens: show first/last 4 chars only
- Hash emails for privacy
- Never log: credit cards, SSN, health data

---

Admin & Privileged Access

Admin Routes

Protect admin routes:
- Require admin role check (not just auth)
- Separate middleware: requireAdmin()
- Log all admin actions
- Add 2FA for admin accounts
- IP whitelist for admin access (optional)

Role-Based Access

Implement RBAC:
- Roles: admin, user, viewer
- Check role on every protected route
- Store roles in JWT or session
- Default: lowest privilege (viewer)
- Require admin approval for role upgrades

---

Third-Party Integrations

API Key Security

Secure third-party API keys:
- Store in environment variables
- Rotate keys every 90 days
- Use separate keys for dev/staging/prod
- Revoke immediately if exposed
- Monitor usage for anomalies

Webhook Security

Verify webhooks (e.g., Stripe):
- Verify signature (HMAC-SHA256)
- Check timestamp (prevent replay)
- Use HTTPS endpoints only
- Rate limit webhook endpoints
- Log all webhook events

---

Quick Security Checklist

Pre-deployment security:
- [ ] All secrets in environment variables
- [ ] Passwords hashed with bcrypt
- [ ] HTTPS forced in production
- [ ] Rate limiting on all APIs
- [ ] Input validation server-side
- [ ] SQL injection prevented (parameterized queries)
- [ ] XSS prevented (sanitized output)
- [ ] CORS configured (not wildcard)
- [ ] Error messages generic (no stack traces)
- [ ] Sessions expire (30-60 min)
- [ ] File uploads validated
- [ ] Security headers set (helmet.js)

---

Testing Security Implementation

Verify authentication:

# Should fail
curl http://localhost:3000/api/protected

# Should succeed with token
curl -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/protected

Test rate limiting:

# Should return 429 after 100 requests
for i in {1..150}; do curl http://localhost:3000/api/endpoint; done

Check for secrets:

# Should find nothing
grep -r "api_key\|password\|secret" src/