Secure Code Guardian

This is your go-to when you need to implement auth flows, hash passwords with bcrypt, set up JWT tokens, or harden endpoints against the OWASP Top 10. It ships with working examples for parameterized queries, Zod validation, rate limiting, and security headers, plus explicit validation checkpoints so you can actually test for SQL injection and privilege escalation before shipping. The constraint list is helpful: it forces bcrypt over MD5, parameterized queries over string interpolation, and secrets in env vars. One thing that stands out is the full-flow endpoint example that ties everything together, from input validation through to httpOnly cookies. If you're writing custom security code rather than plugging in an auth provider, this keeps you from missing the obvious holes.

skills.sh installs: 5.4K
GitHub stars: 12.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add jeffallan/claude-skills --skill secure-code-guardian --agent claude-code

Installs into .claude/skills of the current project.

Files

Secure Code Guardian

Core Workflow

Threat model — Identify attack surface and threats
Design — Plan security controls
Implement — Write secure code with defense in depth; see code examples below
Validate — Test security controls with explicit checkpoints (see below)
Document — Record security decisions

Validation Checkpoints

After each implementation step, verify:

Authentication: Test brute-force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid-credential error messages (must not leak user existence).
Authorization: Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users.
Input handling: Confirm SQL injection payloads (' OR 1=1--) are rejected; confirm XSS payloads (<script>alert(1)</script>) are escaped or rejected.
Headers/CORS: Validate with a security scanner (e.g., curl -I, Mozilla Observatory) that security headers are present and CORS origin allowlist is correct.