# Security Patterns

Implements authentication, authorization, encryption, secrets management, and security...

- Repository: https://github.com/CloudAI-X/claude-workflow-v2 (1421 stars)
- Category: Design
- License: MIT
- Last updated: 2026-10-06
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add CloudAI-X/claude-workflow-v2 --skill security-patterns -g -a claude-code -y`
Codex: `npx skills add CloudAI-X/claude-workflow-v2 --skill security-patterns -g -a codex -y`
Cursor: `npx skills add CloudAI-X/claude-workflow-v2 --skill security-patterns -g -a cursor -y`
Gemini CLI: `npx skills add CloudAI-X/claude-workflow-v2 --skill security-patterns -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add CloudAI-X/claude-workflow-v2`

## Description

Implements authentication, authorization, encryption, secrets management, and security hardening patterns. Use when designing auth flows, managing secrets, configuring CORS, implementing rate limiting, or when asked about JWT, OAuth, password hashing, API keys, RBAC, or security best practices.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Patterns

### When to Load

- **Trigger**: Auth flows, encryption, secrets management, CORS configuration, input validation, rate limiting
- **Skip**: No security surface involved in the current task

## Security Implementation Workflow

Copy this checklist and track progress:

```
Security Implementation Progress:
- [ ] Step 1: Choose authentication strategy
- [ ] Step 2: Implement authorization model
- [ ] Step 3: Set up password hashing
- [ ] Step 4: Configure secrets management
- [ ] Step 5: Enable encryption (transit + rest)
- [ ] Step 6: Configure CORS
- [ ] Step 7: Add rate limiting
- [ ] Step 8: Validate against anti-patterns checklist
```

## Authentication Patterns

### JWT (JSON Web Tokens)

```typescript
import jwt from "jsonwebtoken";

function generateTokens(user: User) {
  const accessToken = jwt.sign(
    { sub: user.id, role: user.role },
    process.env.JWT_SECRET!,
    { expiresIn: "15m", algorithm: "HS256" },
  );
  const refreshToken = jwt.sign(
    { sub: user.id, tokenVersion: user.tokenVersion },
    process.env.JWT_REFRESH_SECRET!,
    { expiresIn: "7d" },
  );
  return { accessToken, refreshToken };
}

// WRONG: localStorage (XSS vulnerable) | CORRECT: httpOnly cookie for refresh, memory for access
res.cookie("refreshToken", refreshToken, {
  httpOnly: true,
  secure: true,
  sameSite: "strict",
  maxAge: 7 * 24 * 60 * 60 * 1000,
  path: "/api/auth/refresh",
});
```

### JWT Verification Middleware

```typescript
function authenticate(req: Request, res: Response, next: NextFunction) {
  const header = req.headers.authorization;
  if (!header?.startsWith("Bearer ")) {
    return res.status(401).json({ error: "Missing token" });
  }

The rest: https://github.com/CloudAI-X/claude-workflow-v2/blob/HEAD/skills/security-patterns/SKILL.md