{"enrichment":{"faq":[{"a":"Security Engineer guides you through JWT authentication setup in Next.js by establishing token generation, validation, and refresh mechanisms. The skill helps you configure secure token storage, implement middleware for route protection, and manage token expiration policies. You'll learn to sign tokens with strong algorithms, validate claims on each request, and handle token refresh flows to maintain secure sessions while preventing token hijacking and ensuring stateless authentication across your application.","q":"How do I implement JWT authentication in Next.js with Security Engineer?"},{"a":"Security Engineer provides detailed strategies to prevent SQL injection by teaching parameterized queries, prepared statements, and ORM best practices. The skill emphasizes input validation, output encoding, and the principle of least privilege for database accounts. You'll learn to sanitize user inputs, use allowlists for expected data formats, and implement Web Application Firewalls (WAF). Security Engineer also covers detection techniques and demonstrates how SQL injection ranks among OWASP Top 10 vulnerabilities that require immediate mitigation.","q":"What does Security Engineer teach about preventing SQL injection attacks in my app?"},{"a":"Security Engineer assists with role-based access control (RBAC) implementation by defining role hierarchies, permission mappings, and enforcement policies. The skill guides you through designing granular permissions, implementing middleware to check user roles before granting access, and managing role assignments. You'll learn to separate authentication (verifying identity) from authorization (checking permissions), use attribute-based access control (ABAC) for complex scenarios, and audit role changes. Security Engineer ensures your RBAC design aligns with the principle of least privilege and supports your application's scalability.","q":"How should Security Engineer help me implement role-based access control?"},{"a":"Security Engineer emphasizes that bcrypt password hashing best practices include using appropriate cost factors (typically 10-12 rounds), never storing plain-text passwords, and always hashing passwords server-side. The skill teaches you to generate unique salts automatically with bcrypt, verify passwords by comparing hashes rather than decrypting, and implement rate limiting on login attempts to prevent brute-force attacks. Security Engineer recommends bcrypt over faster algorithms for password storage because its intentional slowness makes cracking attempts computationally expensive, protecting your users even if your database is compromised.","q":"What are bcrypt password hashing best practices according to Security Engineer?"},{"a":"Security Engineer provides frameworks for implementing rate limiting on login endpoints to prevent brute-force and credential-stuffing attacks. The skill teaches you to track failed login attempts per IP address and username, implement exponential backoff delays after repeated failures, and temporarily lock accounts after threshold breaches. You'll learn to configure rate limits using middleware, cache solutions like Redis, or API gateway tools. Security Engineer emphasizes monitoring rate-limit triggers as security events, logging them for audit purposes, and balancing security with user experience by allowing legitimate users to recover access through verified recovery channels.","q":"How does Security Engineer help set up rate limiting for login endpoints?"},{"a":"Security Engineer conducts security reviews ensuring compliance with OWASP Top 10 vulnerabilities including injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, XSS, insecure deserialization, using components with known vulnerabilities, and insufficient logging. The skill provides assessment frameworks to identify gaps in your application, prioritize remediation efforts, and implement controls for each vulnerability class. Security Engineer helps you establish continuous security testing practices, vulnerability scanning routines, and documentation standards that demonstrate compliance to stakeholders and maintain security posture as your application evolves.","q":"What guidance does Security Engineer provide for OWASP Top 10 compliance and security reviews?"}],"shadow_tags":["auth-patterns","vulnerability-prevention","data-encryption","access-control","secure-coding","compliance-standards","threat-modeling","api-security","secret-management","incident-response"],"summary_rewrite":"Security Engineer provides a comprehensive framework for implementing authentication and authorization in web applications. Leverage AI-assisted development standards to design secure access controls, manage user credentials, and enforce permission policies across your platform."},"files":[{"bytes":18039,"path":"skills/security-engineer/SKILL.md","sha256":"b89b998034b99a0eb9524e0e5474aa67dc2ca313da0cdfaf9a908b8be9b4b8cb","url":"https://skillfed.io/files/daffy0208/ai-dev-standards/security-engineer/30614ea6/SKILL.md"}],"id":"daffy0208/ai-dev-standards/security-engineer","links":{"html":"https://skillfed.io/daffy0208/ai-dev-standards/security-engineer","md":"https://skillfed.io/daffy0208/ai-dev-standards/security-engineer.md","repo":"https://github.com/daffy0208/ai-dev-standards"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":7,"language":"TypeScript","last_updated":"2025-12-25","license":"MIT","name":"Security Engineer","publisher":"daffy0208","stars":32},"relations":{"similar":[{"id":"hoodini/ai-agents-skills/owasp-security"},{"id":"personamanagmentlayer/pcl/security-expert"},{"id":"travisjneuman/.claude/application-security"},{"id":"shashankswe2020-ux/whoop-mcp/security-and-hardening"},{"id":"daffy0208/ai-dev-standards/security-architect"},{"id":"AIDotNet/MoYuCode/security-scanner"},{"id":"CloudAI-X/claude-workflow-v2/security-patterns"},{"id":"CuriousLearner/devkit/compliance-checker"},{"id":"miles990/claude-software-skills/security-practices"},{"id":"DanielPodolsky/ownyourcode/security"}]},"slug":{"owner":"daffy0208","repo":"ai-dev-standards","skill":"security-engineer"},"version":"30614ea6"}