Security Patterns

This one's a practical reference for implementing auth and security patterns correctly. It walks through JWT vs session auth, shows you how to avoid common mistakes like storing tokens in localStorage or using timing-vulnerable comparisons, and includes working code for RBAC, password hashing with bcrypt, API key authentication, and CORS configuration. The side-by-side "wrong vs correct" examples are genuinely helpful, like pointing out that "invalid password" error messages leak information about which emails exist in your system. Load it when you're building login flows, managing secrets, or need to remember the proper way to set httpOnly cookies. It won't teach you security from scratch, but it's solid for avoiding the footguns.

skills.sh installs: 132
GitHub stars: 1.4K
last updated: Jun 9, 2026

View on GitHub

Install

$ npx -y skills add cloudai-x/claude-workflow-v2 --skill security-patterns --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Patterns

When to Load

Trigger: Auth flows, encryption, secrets management, CORS configuration, input validation, rate limiting
Skip: No security surface involved in the current task

Security Implementation Workflow

Copy this checklist and track progress:

Security Implementation Progress:
- [ ] Step 1: Choose authentication strategy
- [ ] Step 2: Implement authorization model
- [ ] Step 3: Set up password hashing
- [ ] Step 4: Configure secrets management
- [ ] Step 5: Enable encryption (transit + rest)
- [ ] Step 6: Configure CORS
- [ ] Step 7: Add rate limiting
- [ ] Step 8: Validate against anti-patterns checklist

Authentication Patterns

JWT (JSON Web Tokens)

import jwt from "jsonwebtoken";

function generateTokens(user: User) {
  const accessToken = jwt.sign(
    { sub: user.id, role: user.role },
    process.env.JWT_SECRET!,
    { expiresIn: "15m", algorithm: "HS256" },
  );
  const refreshToken = jwt.sign(
    { sub: user.id, tokenVersion: user.tokenVersion },
    process.env.JWT_REFRESH_SECRET!,
    { expiresIn: "7d" },
  );
  return { accessToken, refreshToken };
}

SKILL.md on GitHub