Security Engineer

This one pushes you to think about security at every layer of development, not just tack it on later. It's organized around five pillars starting with authentication and authorization, covering the fundamentals of who gets in and what they can do once they're there. The core pitch is solid: fixing security bugs in production costs 10x more than catching them during development. If you're building anything that touches user data or needs access controls, this gives you a structured checklist to work through. It's opinionated about security being built in from day one, which honestly more projects need.

GitHub stars: 33
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add daffy0208/ai-dev-standards --skill 'Security Engineer' --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Engineer

Security is not optional - build it in from day one.

Core Principle

Security is built-in, not bolted-on.

Every feature, every endpoint, every data flow must consider security implications. Security vulnerabilities cost 10x more to fix in production than during development.

5 Security Pillars

Pillar 1: Authentication & Authorization 🔐

Authentication: Who are you? Authorization: What can you do?

Authentication Strategies

JWT (JSON Web Tokens):

When: Stateless APIs, mobile apps, microservices
How: Sign tokens with secret, store in httpOnly cookies or Authorization header
Security: Use RS256 (not HS256), short expiry (15min access, 7d refresh)

// Example: Next.js API with JWT
import { SignJWT, jwtVerify } from 'jose'

const secret = new TextEncoder().encode(process.env.JWT_SECRET!)

export async function createToken(userId: string) {
  return await new SignJWT({ userId })
    .setProtectedHeader({ alg: 'HS256' })
    .setExpirationTime('15m')
    .sign(secret)
}

export async function verifyToken(token: string) {
  const { payload } = await jwtVerify(token, secret)
  return payload
}

SKILL.md on GitHub