dotfiles/cursor/skills/app-security-checklist/SKILL.md

name, description, metadata

name	description	metadata
app-security-checklist	Application security checklist when adding auth, APIs, user input, uploads, payments, or handling secrets. Use for security review of app code (not the Cursor /review-security subagent launcher).	origin imported ECC security-review cherry-pick (lean) 2026-07-29

App security checklist (lean)

Use when implementing or reviewing auth, APIs, uploads, secrets, or sensitive data. For Cursor’s built-in branch security review subagent, use /review-security instead.

Secrets

• No hardcoded keys/tokens/passwords in source
• App secrets → Infisical (/apps/<repo>); infra → Ansible Vault
• Local .env gitignored; commit *.example only
• Never log secrets, full tokens, card numbers, or passwords

Input & data

• Validate/parse untrusted input (schema libs OK: zod, pydantic, etc.)
• Parameterized queries / ORM only — no string-concat SQL
• Uploads: size + type/extension allowlist; store outside web root when possible
• Sanitize any user HTML; prefer framework auto-escaping

AuthZ

• Check authorization on every sensitive action (not only at login)
• Prefer httpOnly + Secure + SameSite cookies over localStorage tokens
• Generic client errors; detail only in server logs

HTTP / abuse

• Rate-limit auth and expensive endpoints
• CSRF protection on cookie-session state changes
• Sensible security headers (CSP without casual unsafe-inline/unsafe-eval)
• CORS allowlist — not * with credentials

Dependencies

• Lockfiles committed; CI uses reproducible install (npm ci / equivalent)
• Do not silence audit/lint gates with || true

Pre-ship gate (short)

Secrets out of git · inputs validated · queries parameterized · authZ on mutations · no secret logging · rate limits on hot paths · CI gates honest.