devs:security-core

What this skill does

# Security Core

Comprehensive application security guidance for TypeScript, Python, and Rust applications.

## Quick Start

### Common Security Tasks

**Setting up authentication:**
1. Generate JWT keys: `./scripts/generate_jwt_keys.sh RS256`
2. Consult [authentication.md](references/authentication.md) for implementation patterns
3. Use security templates from `assets/configs/`

**Implementing authorization:**
1. Review [authorization.md](references/authorization.md) for RBAC/ABAC/RLS patterns
2. For Supabase: See RLS section with multi-tenant examples
3. Implement permission checking at API and database layers

**Security auditing:**
1. Run: `./scripts/audit_security.sh`
2. Review [code-review.md](references/code-review.md) checklist
3. Check [owasp-top-10.md](references/owasp-top-10.md) for vulnerabilities

**Hardening application:**
1. Apply security headers from [security-headers.md](references/security-headers.md)
2. Implement rate limiting from [rate-limiting.md](references/rate-limiting.md)
3. Configure secrets management per [secrets-management.md](references/secrets-management.md)

## When to Use This Skill

### Authentication Scenarios
- Implementing login/signup flows
- Adding JWT or session-based authentication
- Integrating OAuth 2.0 providers
- **OAuth for CLI, TUI, or desktop applications** (Device Flow)
- Multi-factor authentication (TOTP, SMS/Email OTP)
- Password hashing and validation

### Authorization Scenarios
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- **Row Level Security (RLS) with Supabase/PostgreSQL**
- Multi-tenant data isolation
- Permission-based access control
- Resource ownership validation

### Security Auditing
- Code security reviews
- Dependency vulnerability scanning
- OWASP Top 10 compliance checks
- Secret detection in code
- Security configuration verification

### Infrastructure Security
- Security headers (CSP, HSTS, X-Frame-Options)
- CORS configuration
- Rate limiting implementation
- Secrets management
- API security hardening

## Core Resources

### Scripts (`scripts/`)

**`audit_security.sh`** - Security audit for TypeScript, Python, and Rust projects
- Runs dependency vulnerability scanners (npm audit, pip-audit, cargo-audit)
- Detects hardcoded secrets in code
- Checks for common security misconfigurations
- Usage: `./scripts/audit_security.sh [project-directory]`

**`generate_jwt_keys.sh`** - Generate secure JWT signing keys
- Supports HS256 (symmetric), RS256 (asymmetric), ES256 (elliptic curve)
- Automatically adds keys to .gitignore
- Provides usage examples
- Usage: `./scripts/generate_jwt_keys.sh [ALGORITHM] [OUTPUT_DIR]`

### Reference Documentation (`references/`)

**[authentication.md](references/authentication.md)** - Complete authentication guide
- JWT implementation (TypeScript, Python, Rust)
- Session-based authentication
- OAuth 2.0 Authorization Code Flow
- **OAuth Device Flow for CLI/TUI/desktop apps** ⭐
- Multi-factor authentication (TOTP, SMS)
- Password security and hashing
- Token storage best practices

**[authorization.md](references/authorization.md)** - Authorization patterns and implementations
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- **Row Level Security (RLS) with Supabase/PostgreSQL** ⭐
- Multi-tenant RLS patterns
- Permission checking patterns
- Resource-based authorization
- Testing authorization logic

**[owasp-top-10.md](references/owasp-top-10.md)** - OWASP Top 10 prevention guide
- A01: Broken Access Control
- A02: Cryptographic Failures
- A03: Injection (SQL, NoSQL, Command)
- A04: Insecure Design
- A05: Security Misconfiguration
- A06: Vulnerable Components
- A07: Authentication Failures
- A08: Data Integrity Failures
- A09: Logging & Monitoring Failures
- A10: Server-Side Request Forgery (SSRF)

**[secrets-management.md](references/secrets-management.md)** - Secrets and credentials management
- Environment variables best practices
- Secret managers (AWS Secrets Manager, HashiCorp Vault)
- Secret rotation strategies
- CI/CD secrets handling
- Local development with .env files

**[security-headers.md](references/security-headers.md)** - HTTP security headers
- Content-Security-Policy (CSP)
- Strict-Transport-Security (HSTS)
- X-Frame-Options, X-Content-Type-Options
- CORS configuration
- Implementation examples for all frameworks

**[rate-limiting.md](references/rate-limiting.md)** - Rate limiting strategies
- Fixed window, sliding window, token bucket
- Implementation in TypeScript, Python, Rust
- Distributed rate limiting with Redis
- Per-user and per-IP limiting
- Rate limit headers and responses

**[code-review.md](references/code-review.md)** - Security code review checklist
- Authentication & authorization checks
- Input validation & sanitization
- Data protection and encryption
- Security headers & configuration
- Session management
- API security
- Common vulnerabilities (XSS, CSRF, SQL injection)

### Configuration Templates (`assets/configs/`)

Ready-to-use security middleware for all supported languages:

**TypeScript:** `assets/configs/typescript/security-config.ts`
- Express + Helmet configuration
- CORS setup
- Rate limiting
- Security headers

**Python:** `assets/configs/python/security_middleware.py`
- FastAPI middleware
- Security headers
- CORS
- Rate limiting with slowapi

**Rust:** `assets/configs/rust/security_middleware.rs`
- Axum middleware
- tower-http CORS layer
- Security headers

## Decision Guides

### Choosing Authentication Method

| Method | Use When | Complexity | Best For |
|--------|----------|------------|----------|
| JWT | Stateless APIs, microservices | Medium | SPAs, mobile apps, APIs |
| Sessions | Traditional web apps | Low | Server-rendered apps |
| OAuth 2.0 | Third-party auth, SSO | High | Delegated authentication |
| API Keys | Service-to-service | Low | Internal services |

See [authentication.md](references/authentication.md) for detailed implementation patterns.

### Choosing Authorization Model

| Model | Use When | Complexity | Best For |
|-------|----------|------------|----------|
| RBAC | Simple role hierarchies | Low | Standard web apps |
| ABAC | Complex, dynamic policies | High | Enterprise apps |
| RLS | Multi-tenant with data isolation | Medium | SaaS applications |
| Permissions | Fine-grained control | Medium | Admin panels, APIs |

See [authorization.md](references/authorization.md) for implementation patterns and RLS examples.

### OAuth for CLI/TUI/Desktop

For applications without traditional browser redirects:

**Device Authorization Flow (OAuth 2.0):**
1. App requests device code
2. User opens browser and enters code
3. App polls for token
4. Token granted after user approval

Full implementation examples in [authentication.md - OAuth for CLI, TUI, and Desktop Apps](references/authentication.md#oauth-for-cli-tui-and-desktop-apps).

## Common Workflows

### 1. Implementing JWT Authentication

```bash
# Generate keys
./scripts/generate_jwt_keys.sh RS256 ./keys

# Review implementation patterns
# See references/authentication.md#jwt-authentication
```

Then implement using examples for your language (TypeScript/Python/Rust).

### 2. Adding Row Level Security (Supabase)

```bash
# Review RLS patterns
# See references/authorization.md#row-level-security-rls
```

Implement RLS policies for multi-tenant isolation:
- Enable RLS on tables
- Create policies for SELECT, INSERT, UPDATE, DELETE
- Use helper functions for complex rules
- Test with different user contexts

### 3. Security Audit Workflow

```bash
# Run automated audit
./scripts/audit_security.sh

# Manual review
# 1. Check references/code-review.md checklist
# 2. Review references/owasp-top-10.md for vulnerabilities
# 3. Verify security headers with references/security-headers.md
# 4. Test rate limiting per references/rate-limiting.md
```

### 4. Hardening New Application

1. **Apply security templates:**
   - Copy appropriate config from `assets/configs/[language]/`
   - Configur