Security Sentinel (World-Class Security Skill)

When to Use

ALWAYS use this skill when:

• Writing/reviewing API routes (especially POST/PATCH/PUT/DELETE)
• Implementing authentication or authorization
• Handling user input (forms, query params, file uploads)
• Working with database queries
• Processing file operations
• Managing environment variables and secrets
• Building payment processing features
• Implementing session management
• Handling sensitive data or encryption
• Before creating pull requests
• Before deployment

Comprehensive Documentation

This skill includes complete security references:

📚 Core References (10,426 lines total)

1. owasp-top-10-complete.md (2,133 lines) - Complete OWASP Top 10 with code examples

   • A01: Broken Access Control (IDOR, path traversal)
   • A02: Cryptographic Failures (weak hashing, hardcoded secrets)
   • A03: Injection (SQL, NoSQL, Command injection)
   • A04: Insecure Design (race conditions, rate limiting)
   • A05: Security Misconfiguration (CORS, error messages)
   • A06: Vulnerable Components (dependency management)
   • A07: Authentication Failures (weak passwords, MFA)
   • A08: Integrity Failures (supply chain, deserialization)
   • A09: Logging Failures (audit trails, monitoring)
   • A10: SSRF (URL validation, IP blocking)

2. authentication-patterns.md (1,529 lines) - Complete authentication guide

   • JWT token authentication
   • Session-based authentication
   • Password hashing (bcrypt, Argon2)
   • Password reset flow
   • Email verification
   • Multi-factor authentication (TOTP)
   • OAuth 2.0 (GitHub, Google)
   • Passwordless authentication (magic links)
   • Refresh token pattern

3. authorization-patterns.md (1,062 lines) - Access control implementation

   • Role-Based Access Control (RBAC)
   • Attribute-Based Access Control (ABAC)
   • Middleware protection
   • API route protection
   • Server Action protection
   • Row-level security (Drizzle patterns)
   • Permission system
   • Resource ownership validation

4. input-validation-complete.md (900 lines) - Zod validation for everything

   • String, number, boolean, enum validation
   • Email, URL, phone, UUID validation
   • File upload validation (images, PDFs, CSVs)
   • Password strength requirements
   • Credit card validation (Luhn algorithm)
   • IP address validation (v4, v6)
   • Async validation (database checks)
   • Error handling and display

5. sql-injection-prevention.md (741 lines) - Drizzle ORM security

   • Parameterized queries (always safe)
   • Dynamic query building
   • Raw SQL safety patterns
   • LIKE query sanitization
   • Database schema security
   • Testing for SQL injection

6. xss-prevention.md (630 lines) - React/Next.js XSS protection

   • React's built-in escaping
   • dangerouslySetInnerHTML with DOMPurify
   • URL sanitization
   • Content Security Policy (CSP)
   • User-generated content handling
   • innerHTML safety

7. csrf-prevention.md (597 lines) - Cross-Site Request Forgery protection

   • SameSite cookies (primary defense)
   • CSRF tokens implementation
   • Double submit cookie pattern
   • Server Actions protection
   • Origin header validation

8. secret-management.md (547 lines) - Secure secret handling

   • Environment variables best practices
   • Secret rotation strategies
   • Encryption at rest (AES-256-GCM)
   • Secret detection (gitleaks, trufflehog)
   • Production secrets (Vercel, AWS, Vault)

9. rate-limiting-patterns.md (826 lines) - Prevent API abuse

   • In-memory rate limiting
   • Redis-based rate limiting
   • API route protection
   • Server Action protection
   • IP-based rate limiting
   • User-based rate limiting
   • Sliding window algorithm
   • Token bucket algorithm

10. security-checklist.md (471 lines) - Pre-deployment audit (250+ items)

    • Authentication security (passwords, sessions, JWT, MFA)
    • Authorization security (access control, RLS)
    • Input validation
    • Data security (secrets, logging, database)
    • File upload security
    • Rate limiting
    • Security headers (CSP, CORS, HSTS)
    • Error handling
    • Dependency security
    • Monitoring and logging
    • Infrastructure security
    • Compliance (GDPR, PCI DSS)

🛠️ Security Tools

• validate-security.py (414 lines) - Automated vulnerability scanner
  • Detects 20+ vulnerability types
  • Scans for hardcoded secrets (API keys, passwords, tokens)
  • Checks for SQL injection patterns
  • Detects XSS vulnerabilities (dangerouslySetInnerHTML, innerHTML)
  • Finds eval() and Function() usage
  • Identifies weak cryptography (MD5, SHA1)
  • Detects insecure randomness
  • Checks for command injection
  • Validates path traversal prevention
  • Tests password hashing strength
  • Audits JWT security
  • Checks CORS configuration
  • Validates cookie security (httpOnly, secure)
  • Reports TypeScript issues (@ts-ignore, any)
  • Exits with error on CRITICAL/HIGH issues
  • Identifies XSS vulnerabilities
  • Finds eval() and Function() usage
  • Detects weak cryptography (MD5, SHA1)
  • Checks for command injection
  • Validates password hashing
  • Finds CORS misconfigurations
  • Checks for missing httpOnly cookies
  • Reports TypeScript issues (@ts-ignore, any types)

🚀 Quick Start

Before implementing ANY security-sensitive feature:

# 1. Read the relevant guide
cat owasp-top-10-complete.md
cat authentication-patterns.md

# 2. Implement following patterns

# 3. Run security scanner
python validate-security.py src/

# 4. Check against security checklist
cat security-checklist.md

When to Use

OWASP Top 10 Security Checks

1. Injection Attacks

SQL Injection

// ❌ DON'T: String concatenation in queries
const query = `SELECT * FROM users WHERE email = '${email}'`
// Vulnerable to: email = "' OR '1'='1"

// ✅ DO: Use Prisma (parameterized queries)
const user = await prisma.user.findUnique({
  where: { email },
})

Command Injection

// ❌ DON'T: Unvalidated shell commands
const fileName = req.body.fileName
exec(`cat ${fileName}`) // Vulnerable to: fileName = "; rm -rf /"

// ✅ DO: Validate input and use safe APIs
const allowedFiles = ['log.txt', 'data.csv']
if (!allowedFiles.includes(fileName)) {
  throw new Error('Invalid file name')
}
const content = await fs.readFile(path.join(SAFE_DIR, fileName))

NoSQL Injection

// ❌ DON'T: Direct object insertion
const user = await db.users.findOne({ email: req.body.email })
// Vulnerable to: { email: { $ne: null } }

// ✅ DO: Validate input with Zod
const emailSchema = z.string().email()
const email = emailSchema.parse(req.body.email)
const user = await db.users.findOne({ email })

2. Broken Authentication

Password Storage

// ❌ DON'T: Plain text passwords
const user = await prisma.user.create({
  data: {
    email,
    password, // Never store plain text!
  },
})

// ✅ DO: Hash with bcrypt
import bcrypt from 'bcrypt'

const hashedPassword = await bcrypt.hash(password, 12) // 12 rounds minimum
const user = await prisma.user.create({
  data: {
    email,
    password: hashedPassword,
  },
})

Session Management

// ❌ DON'T: Weak session tokens
const sessionId = Math.random().toString()

// ✅ DO: Cryptographically secure tokens
import crypto from 'crypto'
const sessionId = crypto.randomBytes(32).toString('hex')

// ✅ DO: Set secure session cookie
res.setHeader('Set-Cookie', [
  `session=${sessionToken}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`,
])

JWT Security

// ❌ DON'T: Weak secret
const token = jwt.sign(payload, 'secret123')

// ✅ DO: Strong secret from environment
const token = jwt.sign(payload, process.env.JWT_SECRET!, {
  expiresIn: '1h',
  algorithm: 'HS256',
})

// ✅ DO: Verify JWT properly
try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET!)
  // Use decoded data
} catch (error) {
  throw new Error('Invalid token')
}

3. Sensitive Data Exposure

Environment Variables

// ❌ DON'T: Hardcoded secrets
const apiKey = 'sk_live_abc123def456'
const dbPassword = 'mypassword123'

// ✅ DO: Environment variables
const apiKey = process.env.STRIPE_API_KEY
const dbPassword = process.env.DATABASE_PASSWORD

if (!apiKey || !dbPassword) {
  throw new Error('Missing required environment variables')
}

Data in Logs

// ❌ DON'T: Log sensitive data
console.log('User data:', { email, password, creditCard })

// ✅ DO: Redact sensitive fields
const safeUserData = {
  email,
  creditCard: creditCard.slice(-4).padStart(creditCard.length, '*'),
}
console.log('User data:', safeUserData)

Never Return Sensitive Data

// ❌ DON'T: Return password in API
const user = await prisma.user.findUnique({ where: { id } })
return user // Includes password hash!

// ✅ DO: Exclude sensitive fields
const user = await prisma.user.findUnique({
  where: { id },
  select: {
    id: true,
    email: true,
    name: true,
    // password field excluded
  },
})
return user

4. XML External Entities (XXE)

// ❌ DON'T: Parse untrusted XML
const doc = xmlParser.parse(userInput)

// ✅ DO: Disable external entities
const parser = new xml2js.Parser({
  explicitChildren: false,
  explicitRoot: false,
  ignoreAttrs: true,
  xmlns: false,
})

5. Broken Access Control

Authorization Checks

// ❌ DON'T: Missing authorization
export async function DELETE(
  request: Request,
  { params }: { params: { id: string } }
) {
  await prisma.project.delete({ where: { id: params.id } })
  return new Response(null, { status: 204 })
}

// ✅ DO: Verify ownership
export async function DELETE(
  request: Request,
  { params }: { params: { id: string } }
) {
  const user = await getAuthUser(request)
  if (!user) {
    return new Response('Unauthorized', { status: 401 })
  }

  const project = await prisma.project.findUnique({
    where: { id: params.id },
  })

  if (!project) {
    return new Response('Not found', { status: 404 })
  }

  if (project.userId !== user.id) {
    return new Response('Forbidden', { status: 403 })
  }

  await prisma.project.delete({ where: { id: params.id } })
  return new Response(null, { status: 204 })
}

IDOR (Insecure Direct Object Reference)

// ❌ DON'T: Trust user input for IDs
const userId = req.query.userId
const data = await getPrivateData(userId) // Any user can access any data!

// ✅ DO: Use authenticated user's ID
const userId = req.user.id // From authenticated session
const data = await getPrivateData(userId)

6. Security Misconfiguration

CORS

// ❌ DON'T: Allow all origins
res.setHeader('Access-Control-Allow-Origin', '*')

// ✅ DO: Whitelist specific origins
const allowedOrigins = [
  'https://app.quetrex.com',
  'https://staging.quetrex.com',
]

const origin = req.headers.get('origin')
if (origin && allowedOrigins.includes(origin)) {
  res.setHeader('Access-Control-Allow-Origin', origin)
}

Error Messages

// ❌ DON'T: Expose internal details
catch (error) {
  res.status(500).json({
    error: error.message, // Could leak stack trace, DB structure, etc.
  })
}

// ✅ DO: Generic error messages
catch (error) {
  console.error('Internal error:', error) // Log internally
  res.status(500).json({
    error: 'An internal error occurred',
  })
}

7. Cross-Site Scripting (XSS)

dangerouslySetInnerHTML

// ❌ DON'T: Unsanitized HTML
<div dangerouslySetInnerHTML={{ __html: userInput }} />
// Vulnerable to: userInput = "<script>alert('XSS')</script>"

// ✅ DO: Sanitize with DOMPurify
import DOMPurify from 'dompurify'

const sanitized = DOMPurify.sanitize(userInput)
<div dangerouslySetInnerHTML={{ __html: sanitized }} />

// ✅ BETTER: Avoid dangerouslySetInnerHTML entirely
<div>{userInput}</div> // React escapes by default

URL Handling

// ❌ DON'T: Unsanitized URLs
<a href={userInput}>Click here</a>
// Vulnerable to: userInput = "javascript:alert('XSS')"

// ✅ DO: Validate URLs
function isSafeUrl(url: string): boolean {
  try {
    const parsed = new URL(url)
    return ['http:', 'https:'].includes(parsed.protocol)
  } catch {
    return false
  }
}

const href = isSafeUrl(userInput) ? userInput : '#'
<a href={href}>Click here</a>

8. Insecure Deserialization

// ❌ DON'T: eval() or Function()
const code = req.body.code
eval(code) // NEVER DO THIS

// ❌ DON'T: Unvalidated JSON
const data = JSON.parse(userInput)
// Use data directly without validation

// ✅ DO: Validate with Zod
const data = JSON.parse(userInput)
const validated = dataSchema.parse(data) // Validates structure and types

9. Using Components with Known Vulnerabilities

# ✅ DO: Regular dependency audits
npm audit --audit-level=high

# ✅ DO: Keep dependencies updated
npm update

# ✅ DO: Use automated tools
npm install -g snyk
snyk test

10. Insufficient Logging & Monitoring

// ❌ DON'T: No logging
export async function POST(request: Request) {
  const user = await createUser(data)
  return Response.json(user)
}

// ✅ DO: Log security events
export async function POST(request: Request) {
  try {
    const user = await createUser(data)
    logger.info('User created', {
      userId: user.id,
      email: user.email,
      ip: request.headers.get('x-forwarded-for'),
      timestamp: new Date().toISOString(),
    })
    return Response.json(user)
  } catch (error) {
    logger.error('User creation failed', {
      error: error.message,
      email: data.email,
      ip: request.headers.get('x-forwarded-for'),
      timestamp: new Date().toISOString(),
    })
    throw error
  }
}

Input Validation Checklist

// ✅ Complete input validation example
import { z } from 'zod'

const createUserSchema = z.object({
  email: z.string().email().max(255),
  password: z
    .string()
    .min(8, 'Password must be at least 8 characters')
    .max(128)
    .regex(/[A-Z]/, 'Password must contain uppercase letter')
    .regex(/[a-z]/, 'Password must contain lowercase letter')
    .regex(/[0-9]/, 'Password must contain number')
    .regex(/[^A-Za-z0-9]/, 'Password must contain special character'),
  name: z.string().min(1).max(100).optional(),
})

export async function POST(request: Request) {
  // 1. Parse and validate input
  const body = await request.json()
  const validated = createUserSchema.parse(body) // Throws on validation error

  // 2. Additional business logic validation
  const existing = await prisma.user.findUnique({
    where: { email: validated.email },
  })
  if (existing) {
    throw new Error('Email already exists')
  }

  // 3. Hash password
  const hashedPassword = await bcrypt.hash(validated.password, 12)

  // 4. Create user
  const user = await prisma.user.create({
    data: {
      email: validated.email,
      password: hashedPassword,
      name: validated.name,
    },
    select: {
      id: true,
      email: true,
      name: true,
      // password excluded
    },
  })

  // 5. Log security event
  logger.info('User registered', { userId: user.id, email: user.email })

  return Response.json(user, { status: 201 })
}

Security Headers

// ✅ DO: Set security headers
export function middleware(request: NextRequest) {
  const response = NextResponse.next()

  response.headers.set('X-Content-Type-Options', 'nosniff')
  response.headers.set('X-Frame-Options', 'DENY')
  response.headers.set('X-XSS-Protection', '1; mode=block')
  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
  response.headers.set(
    'Content-Security-Policy',
    "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';"
  )
  response.headers.set(
    'Strict-Transport-Security',
    'max-age=31536000; includeSubDomains'
  )

  return response
}

Security Review Checklist

For each code change, verify:

• All user input validated with Zod
• No hardcoded secrets (use environment variables)
• SQL queries parameterized (using Prisma)
• Passwords hashed with bcrypt (12+ rounds)
• JWT tokens use strong secret and expire
• Authorization checks on all protected routes
• No dangerouslySetInnerHTML without DOMPurify
• No eval() or Function() with user input
• CORS configured for specific origins
• Error messages don't leak internal details
• Security headers set correctly
• Sensitive data excluded from API responses
• Security events logged
• Dependencies audited (npm audit)
• HTTPS enforced in production