Security-First Development
Claude CodeCLAUDE.mdCoding
OWASP-aligned security rules: input validation, auth patterns, secrets handling, and XSS prevention.
Get this skill
Add the skill file with the CLI, by hand, or over MCP.Save this to your project or home directory so Claude Code can load it.
npx goodprompts add security-first-developmentSaves to
./CLAUDE.mdnpx goodprompts add security-first-developmentSaves to
./CLAUDE.mdSkill file
CLAUDE.md1,776 characters# Security-First Development
## Input Validation
- Validate ALL user input at the API boundary with Zod schemas.
- Validate on the server even if the client validates too.
- Sanitize HTML output to prevent XSS. Use a library, don't regex.
- Reject unexpected fields (use `z.object().strict()`).
- Limit string lengths, array sizes, and nesting depth.
## Authentication
- Use established auth libraries (Better Auth, NextAuth, Lucia). Never roll your own.
- Store sessions server-side. Use httpOnly, secure, sameSite cookies.
- Implement CSRF protection on all state-changing endpoints.
- Rate-limit login attempts (5 per minute per IP).
- Require re-authentication for sensitive operations (password change, email change).
## Authorization
- Check permissions on every request. Never trust client-side auth state.
- Use middleware for role-based access control.
- Verify resource ownership: `WHERE userId = currentUser.id`.
- Return 404 (not 403) for resources the user shouldn't know exist.
## Secrets
- Never commit secrets to git. Use environment variables.
- Rotate secrets regularly. Support multiple active keys during rotation.
- Use different secrets per environment (dev, staging, prod).
- Audit secret access. Log when secrets are read.
## Headers & Transport
- Set security headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options.
- HTTPS everywhere. Redirect HTTP to HTTPS.
- Set appropriate CORS origins. Never use `*` in production.
- Use Subresource Integrity (SRI) for CDN scripts.
## Data Protection
- Hash passwords with bcrypt or argon2. Never MD5 or SHA-256 alone.
- Encrypt sensitive data at rest (PII, tokens, keys).
- Log access to sensitive data for audit trails.
- Implement data retention policies. Delete what you don't need.