Dev-Security — Production Security Hardening
Treat security as a build constraint, not a cleanup step.
This skill is the authoritative source for authentication, authorization, input validation, secrets, headers, rate limiting, supply-chain security policy and evidence requirements, PII handling, and agentic AI safety.
Validation ownership split: this skill owns what the validation schema enforces (content/policy); placement (boundary-only validation) is owned by dev-architecture §4.
dev-backend delegates here for policy and verification depth.
dev-frontend remains responsible for UI implementation, but frontend security touchpoints such as CSP compliance, CORS behavior, XSS prevention, and dependency auditing are defined here.
This skill activates by change-surface whenever code crosses a trust boundary or changes the blast radius of a failure.
Before security work, read dev for classification, fast paths, rule authority, family invariants, verification, and safety; current CVEs/public evidence follow its Conditional Routes.
Threat Model First
Rule (SEC-THREAT-01): Security-sensitive changes start with a repo-grounded threat model, then controls. Do not begin with a checklist and assume it is sufficient.
Before implementation, read the threat-model procedure; before completion, read the applicable security review and must-pass addenda.
Modular References
| Condition | Reference |
|---|---|
| Before security-sensitive implementation | Threat model |
| Input validation, login/session/token/OAuth, authorization, or sensitive flows | Access controls |
| Secrets, headers/CSP/CORS, or abuse/rate limits | Runtime controls |
| AI-suggested dependencies, security claims/static checks, agent configuration, MCP, or sandboxing | Agent integrity and scans (SEC-ANTIPATTERN-01) |
| Security-sensitive completion, deploy/release, uploads/payments/logging/PII, or control ownership | Security review and ownership matrix, ASVS checklist |
| Any security-sensitive code | OWASP Top 10 |
| JS/TS, Python, SQL, or Go security work | Language quirks |
| Before claiming code is secure | Static analysis recipes |
| Tool-using agents or prompt-driven flows | Agentic AI |
| LLMs, RAG, or tool/agent output | LLM supply chain |
| Add/vet MCP servers | MCP supply chain |
| Dependency audit or release integrity | SBOM and signing |
| Domain implementation, CI credential delivery/signing, frontend, testing, review, RCA, scaffolding, or pipelines | Companion owners; load the domain skill too |
Read only the references relevant to the current task. A small CSS change needs no OWASP reference. Auth, data access, secrets, file uploads, webhooks, or incident response changes do.
