Security And Hardening

This is a comprehensive security checklist that enforces the kind of paranoid thinking production code actually needs. It walks you through OWASP Top 10 prevention with real TypeScript examples, from parameterized queries and bcrypt hashing to helmet middleware and Zod validation at route boundaries. The three-tier boundary system (always do, ask first, never do) is genuinely useful for keeping security decisions consistent across a codebase. The npm audit triage decision tree alone is worth the read because it gives you a framework for prioritizing CVE fixes instead of treating every moderate severity warning like a five-alarm fire. If you're touching auth, user input, or external APIs, this covers the non-negotiables.

install copies · 90 days. Times the install command was copied on this site in the last 90 days, bots filtered.: 5
skills.sh installs: 81.4K
GitHub stars: 114.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add addyosmani/agent-skills --skill security-and-hardening --agent claude-code

Installs into .claude/skills of the current project.

Files

Security and Hardening

Overview

Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems.