---
name: ecc-security-review
description: Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing security-critical features. Provides a systematic security review checklist.
---

# Security Review

Use when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing security-critical features.

## Authentication & Authorization

- [ ] Use password hashing (bcrypt/argon2), never plaintext
- [ ] Implement rate limiting on login endpoints
- [ ] Use session tokens with proper expiry
- [ ] Implement MFA for sensitive operations
- [ ] Follow least privilege principle for API keys
- [ ] Validate JWT signatures and expiry server-side

## Input Validation

- [ ] Validate all user input on server side (never trust client)
- [ ] Use parameterized queries to prevent SQL injection
- [ ] Sanitize HTML output to prevent XSS
- [ ] Validate file uploads (type, size, content)
- [ ] Set appropriate Content-Type and charset headers
- [ ] Use CSP headers to prevent script injection

## Secrets Management

- [ ] Never hardcode secrets in source code
- [ ] Use environment variables or secret stores
- [ ] Rotate API keys and credentials regularly
- [ ] Audit secret access logs
- [ ] Use `.env.example` not `.env` in version control

## API Security

- [ ] Use HTTPS everywhere
- [ ] Implement CORS with specific origins, not wildcards
- [ ] Add request size limits
- [ ] Log security-relevant events
- [ ] Implement proper error handling (don't leak stack traces)
- [ ] Use API versioning

## Data Protection

- [ ] Encrypt sensitive data at rest and in transit
- [ ] Implement data retention and deletion policies
- [ ] Mask/redact sensitive data in logs
- [ ] Use proper backup encryption
- [ ] Implement access controls for data export

## Infrastructure

- [ ] Keep dependencies updated
- [ ] Use minimal Docker images
- [ ] Run containers as non-root user
- [ ] Enable firewall rules
- [ ] Use read-only filesystems where possible
- [ ] Implement monitoring and alerting

## Pitfalls

- Custom cryptography is almost always wrong — use established libraries
- Don't roll your own auth — use established frameworks
- Security through obscurity is not security
- Always validate on the server, never on the client alone
