security-basics

Find the weaknesses in an application's login and session design (passwords, sessions and cookies, OAuth and OIDC with PKCE, state and redirect URIs, MFA, password reset, account enumeration, rate limiting), then report findings by severity with the corrected flow. Use when asked "is our login flow secure?", when designing or reviewing authentication, integrating an identity provider, or after an account takeover. Not for in-app authorization rules beyond noting where they belong, or for implementing cryptography.

Review a web application's Cross-Origin Resource Sharing configuration (allowed origins, credentials, methods, headers, preflight caching, exposed headers) against a checklist of the mistakes that leak data cross-site or break legitimate clients, and produce the correct configuration for the framework or gateway in use. Use when a browser says "blocked by CORS policy", when an API must be called from another origin, or when a scanner flags a permissive policy. Not for CSRF defence in general (CORS is not a CSRF mechanism; the checklist says what is) and not for CSP.

Read the JSON output of npm audit, yarn audit, pip-audit or cargo audit with a bundled script that ranks vulnerable packages by severity, separates fixable from unfixable and direct from transitive, and names the packages to upgrade first; then plan the upgrades, overrides and accepted risks with expiry dates. Use when an audit fails CI, when asked "what do we do about these vulnerabilities?", or to triage dependency alerts. Not for finding new vulnerabilities (it reads the tool's output offline) or for licence compliance.

Review a change for what it adds to the attack surface before it merges: a bundled script scans only the added lines of a saved git or gh diff for new network calls, shell and process execution, unsafe deserialisation, SQL built from strings, credential-shaped literals, disabled TLS checks and new permissions in workflows and manifests, with file and line. Use when asked "is this PR safe security-wise?" or for a security pass on one diff. Not for a general review (review-checklist) or a whole-repository secrets scan (secrets-hygiene).

Grade the security headers of a saved HTTP response (HSTS, CSP, nosniff, frame protection, Referrer-Policy, Permissions-Policy, cookie flags, CORS with credentials, disclosure, caching) with a bundled script, then write the header set for the server or framework. Use when asked "are our security headers ok?", to fix a scanner finding, or to configure headers for a new app. Not for fetching live sites (nothing is fetched) or authoring a strict CSP for a large single-page app.

Decode a JSON Web Token without verifying it with a bundled script that prints the header and claims with times explained, and flags unsafe settings (alg none, empty signature, missing or long expiry, jku or x5u headers, suspicious kid, symmetric algorithms, sensitive claims in the payload), then review how the application issues and verifies tokens. Use when asked to "decode this JWT", when debugging authentication, or when reviewing a token design. Not for verifying signatures (the application does that with its key) and not for OAuth server implementation.

Find leaked credentials (cloud and SaaS keys, private keys, tokens, connection strings, high-entropy assignments) in a repository, directory or staged files with a bundled script that redacts them, check .env files are ignored, keep a baseline of accepted findings, and guide rotation and cleanup. Use when asked "did I commit a secret?", before open-sourcing, to add a pre-commit hook, or after a leak. Not for managing secrets or replacing the platform's secret scanning; it complements it offline.