# Security Hardening

Application security covering input validation, auth, headers, secrets management, and...

- Repository: https://github.com/rohitg00/awesome-claude-code-toolkit (2800 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-05-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add rohitg00/awesome-claude-code-toolkit --skill security-hardening -g -a claude-code -y`
Codex: `npx skills add rohitg00/awesome-claude-code-toolkit --skill security-hardening -g -a codex -y`
Cursor: `npx skills add rohitg00/awesome-claude-code-toolkit --skill security-hardening -g -a cursor -y`
Gemini CLI: `npx skills add rohitg00/awesome-claude-code-toolkit --skill security-hardening -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add rohitg00/awesome-claude-code-toolkit`

## Description

Application security covering input validation, auth, headers, secrets management, and dependency auditing

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Hardening

## Input Validation

Validate all input at the boundary. Never trust client-side validation alone.

```typescript
import { z } from 'zod';

const CreateUserSchema = z.object({
  email: z.string().email().max(255),
  name: z.string().min(1).max(100).regex(/^[a-zA-Z\s'-]+$/),
  age: z.number().int().min(13).max(150),
});

function createUser(req: Request) {
  const result = CreateUserSchema.safeParse(req.body);
  if (!result.success) {
    return { status: 400, errors: result.error.flatten().fieldErrors };
  }
  // result.data is typed and validated
}
```

Rules:
- Validate type, length, format, and range on every input
- Use allowlists over denylists (accept known good, reject everything else)
- Validate file uploads: check MIME type, file extension, and magic bytes
- Limit request body size at the server/proxy level (e.g., 1MB max)

## Output Encoding

```typescript
// Prevent XSS: encode output based on context
// HTML context: use framework auto-escaping (React does this by default)
// Never use dangerouslySetInnerHTML with user input

// URL context: encode parameters
const safeUrl = `/search?q=${encodeURIComponent(userInput)}`;

// JSON context: use JSON.stringify (handles escaping)
const safeJson = JSON.stringify({ query: userInput });
```

Never construct HTML strings with user input. Use templating engines with auto-escaping enabled.

## SQL Injection Prevention

```python
# NEVER do this
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

# Always use parameterized queries
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
```

```typescript
// NEVER do this
db.query(`SELECT * FROM users WHERE email = '${email}'`);

// Always use parameterized queries
db.query("SELECT * FROM users WHERE email = $1", [email]);
```

Use an ORM or query builder. If writing raw SQL, always parameterize.

## CSRF Protection

```typescript
// Server: generate and validate CSRF tokens
import { randomBytes } from 'crypto';

The rest: https://github.com/rohitg00/awesome-claude-code-toolkit/blob/HEAD/skills/security-hardening/SKILL.md