Harden

Security as a constraint on every line that touches user data, auth, or external systems. This skill is proactive: applied during implementation, not after. For reactive scans, use safe-repo (sensitive data) or deps-audit (CVEs).

Three-Tier Boundary System

Always do (no exceptions)

• Validate every external input at the system boundary (route handler, API entry)
• Parameterize all database queries (never concatenate user input into SQL)
• Encode output to prevent XSS — use framework auto-escaping, don't bypass it
• HTTPS for all external communication
• Hash passwords with bcrypt/scrypt/argon2 (salt rounds ≥ 12); never plaintext
• Set security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options
• Session cookies: httpOnly, secure, sameSite
• Use environment variables for secrets; reference, never inline
• Strip sensitive fields from API responses by default

Ask first (human approval required)