Security Engineer
Security Engineer provides a comprehensive framework for implementing authentication and authorization in web applications. Leverage AI-assisted development standards to design secure access controls, manage user credentials, and enforce permission policies across your platform.
Security Engineer guides you through JWT authentication setup in Next.js by establishing token generation, validation, and refresh mechanisms. The skill helps you configure secure token storage, implement middleware for route protection, and manage token expiration policies. You'll learn to sign tokens with strong algorithms, validate claims on each request, and handle token refresh flows to maintain secure sessions while preventing token hijacking and ensuring stateless authentication across your application.
AI-generated summary based on this skill's SKILL.md
Install
daffy0208/ai-dev-standards/security-engineer · repository language: TypeScript
git clone https://github.com/daffy0208/ai-dev-standards
cp -r ai-dev-standards/skills/security-engineer ~/.claude/skills/security-engineerFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I implement JWT authentication in Next.js with Security Engineer?
Security Engineer guides you through JWT authentication setup in Next.js by establishing token generation, validation, and refresh mechanisms. The skill helps you configure secure token storage, implement middleware for route protection, and manage token expiration policies. You'll learn to sign tokens with strong algorithms, validate claims on each request, and handle token refresh flows to maintain secure sessions while preventing token hijacking and ensuring stateless authentication across your application.
What does Security Engineer teach about preventing SQL injection attacks in my app?
Security Engineer provides detailed strategies to prevent SQL injection by teaching parameterized queries, prepared statements, and ORM best practices. The skill emphasizes input validation, output encoding, and the principle of least privilege for database accounts. You'll learn to sanitize user inputs, use allowlists for expected data formats, and implement Web Application Firewalls (WAF). Security Engineer also covers detection techniques and demonstrates how SQL injection ranks among OWASP Top 10 vulnerabilities that require immediate mitigation.
How should Security Engineer help me implement role-based access control?
Security Engineer assists with role-based access control (RBAC) implementation by defining role hierarchies, permission mappings, and enforcement policies. The skill guides you through designing granular permissions, implementing middleware to check user roles before granting access, and managing role assignments. You'll learn to separate authentication (verifying identity) from authorization (checking permissions), use attribute-based access control (ABAC) for complex scenarios, and audit role changes. Security Engineer ensures your RBAC design aligns with the principle of least privilege and supports your application's scalability.
What are bcrypt password hashing best practices according to Security Engineer?
Security Engineer emphasizes that bcrypt password hashing best practices include using appropriate cost factors (typically 10-12 rounds), never storing plain-text passwords, and always hashing passwords server-side. The skill teaches you to generate unique salts automatically with bcrypt, verify passwords by comparing hashes rather than decrypting, and implement rate limiting on login attempts to prevent brute-force attacks. Security Engineer recommends bcrypt over faster algorithms for password storage because its intentional slowness makes cracking attempts computationally expensive, protecting your users even if your database is compromised.
How does Security Engineer help set up rate limiting for login endpoints?
Security Engineer provides frameworks for implementing rate limiting on login endpoints to prevent brute-force and credential-stuffing attacks. The skill teaches you to track failed login attempts per IP address and username, implement exponential backoff delays after repeated failures, and temporarily lock accounts after threshold breaches. You'll learn to configure rate limits using middleware, cache solutions like Redis, or API gateway tools. Security Engineer emphasizes monitoring rate-limit triggers as security events, logging them for audit purposes, and balancing security with user experience by allowing legitimate users to recover access through verified recovery channels.
What guidance does Security Engineer provide for OWASP Top 10 compliance and security reviews?
Security Engineer conducts security reviews ensuring compliance with OWASP Top 10 vulnerabilities including injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, XSS, insecure deserialization, using components with known vulnerabilities, and insufficient logging. The skill provides assessment frameworks to identify gaps in your application, prioritize remediation efforts, and implement controls for each vulnerability class. Security Engineer helps you establish continuous security testing practices, vulnerability scanning routines, and documentation standards that demonstrate compliance to stakeholders and maintain security posture as your application evolves.
SKILL.md
rendered from the published skill — quoted content, verbatim
Security Engineer
Security is not optional - build it in from day one.
Core Principle
Security is built-in, not bolted-on.
Every feature, every endpoint, every data flow must consider security implications. Security vulnerabilities cost 10x more to fix in production than during development.
5 Security Pillars
Pillar 1: Authentication & Authorization 🔐
Authentication: Who are you? Authorization: What can you do?
Authentication Strategies
JWT (JSON Web Tokens):
- When: Stateless APIs, mobile apps, microservices
- How: Sign tokens with secret, store in httpOnly cookies or Authorization header
- Security: Use RS256 (not HS256), short expiry (15min access, 7d refresh)
```typescript // Example: Next.js API with JWT import { SignJWT, jwtVerify } from 'jose'
const secret = new
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 3 files
skills/security-engineer/README.md
skills/security-engineer/SKILL.md
skills/security-engineer/manifest.yaml