Security Testing Verification

This is your pre-deployment security checklist in runnable form. It walks you through testing CSRF protection (token validation, reuse prevention), rate limiting (verifies 429s kick in after threshold), input sanitization (XSS, length checks), security headers (CSP, X-Frame-Options), and auth boundaries. The real value is the copy-paste curl commands and automated test scripts that let you verify everything actually works before you ship. It's built around Node.js apps using Clerk for auth and assumes you've already implemented the security features. Think of it as the verification step, not the implementation guide. If you're deploying without testing your rate limits or CSRF tokens, this gives you the commands to prove they're working.

skills.sh installs: 198
GitHub stars: 18
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add harperaa/secure-claude-skills --skill security-testing-verification --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Testing & Verification

Built-In Security Tests

This project includes automated tests and verification scripts for all security features.

Testing Rate Limiting

Automated Test Script

# Run the provided test script
node scripts/test-rate-limit.js

What it tests:

Makes 10 consecutive requests to rate-limited endpoint
Verifies first 5 succeed (HTTP 200)
Verifies requests 6-10 are blocked (HTTP 429)
Tests rate limit reset after 60 seconds

Expected output:

Testing Rate Limiting (5 requests/minute per IP)
Request  1: ✓ 200 - Success
Request  2: ✓ 200 - Success
Request  3: ✓ 200 - Success
Request  4: ✓ 200 - Success
Request  5: ✓ 200 - Success
Request  6: ✗ 429 - Too many requests
Request  7: ✗ 429 - Too many requests
Request  8: ✗ 429 - Too many requests
Request  9: ✗ 429 - Too many requests
Request 10: ✗ 429 - Too many requests

✓ Rate limiting is working correctly!

Manual Testing

# Test rate limiting manually
for i in {1..10}; do
  echo "Request $i:"
  curl -s -o /dev/null -w "%{http_code}\n" \
    http://localhost:3000/api/test-rate-limit
  sleep 0.1
done

SKILL.md on GitHub