Netsuite Owasp Secure Coding
You need this when you're writing or reviewing SuiteScript and want to catch security issues before they ship. It covers the full OWASP Top 10 with actual code patterns, not just principles. You get 48 cataloged security pitfalls with bad and good examples, five-context output encoding templates, CSP header construction, file upload validation pipelines, and RESTlet hardening patterns. It's built for implementation depth, meaning you can use it during code review or when you're stuck on how to properly sanitize user input in a specific context. The auto-activation triggers are smart enough to kick in when you mention injection, XSS, auth patterns, or even when your code includes RESTlet decorators or SuiteQL queries.
- skills.sh installs
- 838
- GitHub stars
- 374
- last updated
- Aug 21, 2026
Install
$ npx -y skills add oracle/netsuite-suitecloud-sdk --skill netsuite-owasp-secure-coding --agent claude-codeInstalls into .claude/skills of the current project.
Files
OWASP Secure Coding Practices
1. Description
This skill provides implementation-depth OWASP secure coding coverage for JavaScript and SuiteScript 2.1 development. It is the primary security reference for writing, reviewing, and auditing code.
What This Skill Covers:
- Complete OWASP Top 10 (2021) mapping with code-level mitigation patterns
- 48 cataloged security pitfalls (OSCP-001 through OSCP-048) with BAD/GOOD code examples
- Platform-agnostic JavaScript security patterns applicable beyond NetSuite
- SuiteScript-specific security patterns for RESTlets, Suitelets, Client Scripts, and more
- Output encoding for five HTML contexts (body, attribute, JavaScript, URL, CSS)
- CSP header construction and deployment
- File upload/download validation pipelines
- API and RESTlet hardening patterns
- AI agent security considerations for tool-assisted development
- DRY security architecture: shared validation modules, centralized encoding, single-source configs
- A mandatory security review checklist for every code review
Relationship to Existing Security Content:
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/oracle/netsuite-suitecloud-sdk
- Categories
- Backend & APIs, Security, AI & Agent Building
- First seen
- Jun 3, 2026
More from oracle/netsuite-suitecloud-sdk
All 7Recommended
More Backend & APIs
maplibre-pmtiles-patternsmaplibre/maplibre-agent-skillsServerless vector and raster tiles with PMTiles for MapLibre GL JS — single-file format, HTTP range requests, hosting on S3/R2/GitHub Pages, generating with Pla833skills.sh installs
efecto-graphic-designpablostanley/efecto-pluginDesign graphic assets with Efecto — presentations, pitch decks, event posters, email headers, blog images, open graph cards, business cards, resumes, menus, inf827skills.sh installs
python-odoo-cursor-rulesmindrally/skillsGuidelines for Python and Odoo enterprise application development with ORM, XML views, and module architecture best practices.818skills.sh installs
feishu-cli-boardriba2534/feishu-cli飞书画板全能操作 · 5 种画图路径任选其一： (A) Mermaid/PlantUML 服务端渲染（思维导图/时序图/类图/饼图/流程图/甘特图，整图作为一个节点，飞书自动排版） (B) Mermaid 本地引擎 whiteboard-cli（绕开 par/参与方数等服务端限制，每个节点可点击编辑） (C) SVG 818skills.sh installs
data-fetchinglobehub/lobehubData fetching architecture guide using Service layer + Zustand Store + SWR. Use when implementing data fetching, creating services, working with store hooks, or812skills.sh installs
encore-frontendencoredev/skillsConnect a frontend application (React, Next.js, Vue, Svelte, etc.) to an Encore.ts backend.806skills.sh installs