Security Practices

Security Practices Skill

> Purpose: Apply security best practices to protect applications

---

Overview

This skill provides security guidelines following OWASP standards and industry best practices.

---

Authentication

Password Security

// Use bcrypt with cost factor 12
import bcrypt from "bcrypt";

const SALT_ROUNDS = 12;

async function hashPassword(password: string): Promise {
  return bcrypt.hash(password, SALT_ROUNDS);
}

async function verifyPassword(
  password: string,
  hash: string,
): Promise {
  return bcrypt.compare(password, hash);
}

JWT Best Practices

// Short-lived access tokens
const accessToken = jwt.sign(payload, SECRET, { expiresIn: "15m" });

// Longer-lived refresh tokens (stored securely)
const refreshToken = jwt.sign({ userId }, REFRESH_SECRET, { expiresIn: "7d" });

---

Input Validation

Never Trust User Input

// SQL Injection vulnerable
const query = `SELECT * FROM users WHERE id = ${userId}`;

// Parameterized query
const user = await prisma.user.findUnique({ where: { id: userId } });

Sanitize Output

// XSS vulnerable
element.innerHTML = userInput;

// Escape HTML
import DOMPurify from "dompurify";
element.innerHTML = DOMPurify.sanitize(userInput);

---

OWASP Top 10 Checklist

| Risk | Mitigation | | :----------------------- | :----------------------------------- | | Injection | Parameterized queries, ORMs | | Broken Auth | Strong passwords, MFA, rate limiting | | Sensitive Data | Encryption at rest/transit, HTTPS | | XXE | Disable XML external entities | | Broken Access | Verify permissions on every request | | Misconfig | Security headers, remove defaults | | XSS | Sanitize output, CSP headers | | Insecure Deserialize | Validate input types | | Components | Keep dependencies updated | | Logging | Log security events, monitor |

---

Security Headers

// Express/NestJS helmet middleware
app.use(helmet());

// Or manually:
res.setHeader("X-Content-Type-Options", "nosniff");
res.setHeader("X-Frame-Options", "DENY");
res.setHeader("X-XSS-Protection", "1; mode=block");
res.setHeader(
  "Strict-Transport-Security",
  "max-age=31536000; includeSubDomains",
);
res.setHeader("Content-Security-Policy", "default-src 'self'");

---

Secrets Management

# Never commit secrets
# .env file with API_KEY=sk-1234...

# Use environment variables
export API_KEY=$(vault read secret/api-key)

# Use secret managers
# AWS Secrets Manager, HashiCorp Vault, etc.

---

Zero Trust Principles

Zero Trust assumes no implicit trust for any entity inside or outside the network perimeter. Every access request is fully authenticated, authorized, and encrypted before granting access.

| Principle | Implementation | Verification | | :--- | :--- | :--- | | Never trust, always verify | Authenticate every request regardless of origin; treat internal traffic the same as external | Audit logs confirm no unauthenticated requests reach protected resources | | Least privilege | Grant minimum permissions required; use role-based and attribute-based access control | Periodic access reviews; automated permission drift detection | | Assume breach | Encrypt data at rest and in transit; segment blast radius; implement intrusion detection | Red team exercises; incident response drills validate containment | | Micro-segmentation | Isolate workloads with network policies; service mesh mTLS between microservices | Verify lateral movement is blocked between segments with penetration testing | | Continuous validation | Re-evaluate trust on every request; session tokens with short TTL; step-up auth for sensitive ops | Monitor for session hijacking; alert on anomalous access patterns | | Device trust | Require managed/compliant devices; verify device posture before granting access | Device compliance checks run at connection time and periodically |

---

OAuth 2.0 / OpenID Connect Flows

Flow Selection Matrix

| Client Type | Recommended Flow | Reason | | :--- | :--- | :--- | | Web app (SPA) | Authorization Code + PKCE | No client secret in browser; PKCE prevents interception | | Web app (server) | Authorization Code | Client secret stored server-side securely | | Mobile / Desktop | Authorization Code + PKCE | Public client; PKCE mandatory | | Machine-to-Machine | Client Credentials | No user interaction; service identity via client secret | | Legacy (avoid) | Implicit | Deprecated; tokens exposed in URL fragment |

Token Storage Requirements

// NEVER store access tokens in localStorage (XSS-accessible)
// NEVER store tokens in sessionStorage for long-lived sessions

// Use httpOnly, Secure, SameSite cookies for refresh tokens
res.cookie("refresh_token", token, {
  httpOnly: true,
  secure: true,
  sameSite: "strict",
  maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
  path: "/api/auth/refresh",
});

// Keep access tokens in memory only (JS variable)
// They are short-lived (15 min) and re-obtained via refresh

PKCE Implementation

import crypto from "crypto";

// Generate code verifier (43-128 chars, unreserved URI characters)
function generateCodeVerifier(): string {
  return crypto.randomBytes(32).toString("base64url");
}

// Derive code challenge from verifier
function generateCodeChallenge(verifier: string): string {
  return crypto.createHash("sha256").update(verifier).digest("base64url");
}

// All public clients MUST use PKCE (RFC 7636)
// Send code_challenge with authorization request
// Send code_verifier with token exchange request

---

API Security

Rate Limiting Patterns

| Strategy | Use Case | Example | | :--- | :--- | :--- | | Per-endpoint | Protect expensive operations | /api/search: 10 req/min | | Per-user | Fair usage enforcement | Authenticated: 1000 req/hr | | Sliding window | Smooth traffic spikes | Rolling 60s window, max 100 | | Token bucket | Burst tolerance | 10 tokens, refill 1/sec | | IP-based | Unauthenticated endpoints | Login: 5 attempts/15 min |

import rateLimit from "express-rate-limit";

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
  keyGenerator: (req) => req.user?.id ?? req.ip,
});

app.use("/api/", apiLimiter);

API Key Management

• Rotate keys on a regular schedule (90 days max) and immediately on suspected compromise
• Scope keys to specific endpoints, methods, and IP ranges
• Never embed keys in client-side code or version control
• Use separate keys for each environment (dev, staging, production)
• Log key usage to detect anomalous patterns

Request Signing

// Sign requests with HMAC to prevent tampering
import crypto from "crypto";

function signRequest(payload: string, secret: string): string {
  return crypto.createHmac("sha256", secret).update(payload).digest("hex");
}

// Verify on server side; reject requests with invalid or expired signatures
// Include timestamp in signed payload to prevent replay attacks

API Versioning Security

• Deprecate and remove old API versions that lack current security controls
• Apply the same authentication and authorization to all active versions
• Monitor traffic to deprecated versions for potential abuse
• Never maintain insecure legacy endpoints for backward compatibility

---

Supply Chain Security

Dependency Auditing

# Run audit on every CI build
npm audit --audit-level=high

# Fix known vulnerabilities
npm audit fix

# Use lockfile-only installs in CI to prevent supply chain attacks
npm ci

Lockfile Integrity

• Always commit package-lock.json to version control
• Use npm ci in CI/CD pipelines (installs from lockfile exactly)
• Review lockfile diffs in pull requests for unexpected changes
• Enable lockfile-lint to enforce registry and integrity hash policies

Dependency Pinning

{
  "dependencies": {
    "express": "4.18.2",
    "prisma": "5.10.0"
  }
}

• Pin exact versions in production applications (no ^ or ~)
• Use Dependabot or Renovate for controlled, reviewed updates
• Separate security patches from feature updates in dependency PRs

Typosquatting Detection

| Technique | Example | | :--- | :--- | | Character swap | expresss instead of express | | Hyphen confusion | lodash-utils mimicking lodash | | Scope squatting | @myorg/config vs @my-org/config |

• Verify package publisher and download counts before installing
• Use npm config set ignore-scripts true for initial installs, then review scripts
• Consider using Socket.dev or Snyk to detect malicious packages automatically

---

Quick Reference

| Practice | Implementation | | :----------- | :-------------------- | | Passwords | bcrypt, Argon2 | | Tokens | Short-lived JWT | | SQL | Parameterized queries | | XSS | Sanitize, CSP | | HTTPS | TLS 1.3, HSTS | | Secrets | Environment, vaults | | Dependencies | npm audit, Snyk | | Logging | Audit trail, no PII | | Zero Trust | Verify every request | | OAuth 2.0 | Auth Code + PKCE | | API Keys | Scoped, rotated | | Supply Chain | Lockfile, pin deps |

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: besync-labs
• Source: besync-labs/antigravity-ai-kit
• License: MIT
• Homepage: https://besync-labs.github.io/antigravity-ai-kit/

Install and usage instructions live in the source repository linked above.