security
Security audit workflow - OWASP Top 10, input validation, auth, secret detection, vulnerability scan
npx skills add vibeeval/vibecosystem --skill security --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Patterns ## OWASP Top 10 (2021) Checklist | # | Vulnerability | Prevention | |---|--------------|------------| | A01 | Broken Access Control | RBAC, resource-level auth, CORS | | A02 | Cryptographic Failures | Encrypt at rest/transit, no PII in logs | | A03 | Injection (SQL/NoSQL/XSS/OS) | Parameterized queries, output encoding, CSP | | A04 | Insecure Design | Threat modeling, secure design patterns | | A05 | Security Misconfiguration | Hardened defaults, no debug in prod | | A06 | Vulnerable Components | npm audit, dependency scan, CVE tracking | | A07 | Auth Failures | Rate limiting, MFA, secure session | | A08 | Data Integrity Failures | Input validation, signed updates, CI/CD security | | A09 | Logging & Monitoring Failures | Audit log, alert on anomaly | | A10 | SSRF | URL allowlist, network segmentation | ## Input Validation ```typescript import { z } from 'zod'; const UserInput = z.object({ email: z.string().email().max(255), name: z.string().min(1).max(100).regex(/^[\w\s-]+$/), age: z.number().int().min(0).max(150), }); // Parameterized query (SQL injection prevention) const user = await db.query('SELECT * FROM users WHERE id = $1', [userId]); ``` ## Auth Best Pr
- OWASP Top 10 (2021) Checklist
- Input Validation
- Auth Best Practices
- Secret Detection
- Security Headers
- Anti-Patterns
- Pentest Methodology (Overview)
- Proof Levels
- Source-to-Sink Taint Tracing
Git hooks ile secret engelleme grep -rn "sk-\|pk_\|ghp_\|xoxb-\|AKIA" --include="*.ts" --include="*.js" src/ grep -rn "password\s*=\s*['\"]" --include="*.ts" src/
What does the security skill do?
Security audit workflow - OWASP Top 10, input validation, auth, secret detection, vulnerability scan
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill security --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.