Defense In Depth Validation

This is the "fix the bug once, then make it structurally impossible" pattern. Instead of adding validation at just the entry point, you add checks at every layer data flows through: API boundaries, business logic, environment guards, and debug instrumentation. The original example is pretty telling: a test passed an empty project directory that caused git init to run in the source code directory. One validation check would have caught that instance, but four layers made it impossible through any code path, including mocks and refactorings. The insight is that each layer catches different failure modes that the others miss. It's more work upfront but you're trading a few extra conditionals for entire categories of bugs that can't happen.

skills.sh installs: 430
GitHub stars: 248
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add secondsky/claude-skills --skill defense-in-depth-validation --agent claude-code

Installs into .claude/skills of the current project.

Files

Defense-in-Depth Validation

Overview

When you fix a bug caused by invalid data, adding validation at one place feels sufficient. But that single check can be bypassed by different code paths, refactoring, or mocks.

Core principle: Validate at EVERY layer data passes through. Make the bug structurally impossible.