global-skills/skills/app-security/SKILL.md

---
name: app-security
description: >
  Harden affected application boundaries when implementing or auditing authorization, uploads, user-influenced outbound requests, or sensitive data handling.
scope: global
---

# Application security

Inspect the affected boundary and existing controls. Apply the protections relevant
to the task; a small fix does not require a full application audit.

1. Validate untrusted payloads with runtime schemas and resource bounds derived
   from product requirements. Reject invalid data; do not silently truncate credentials.
2. Derive identity from verified server authentication. Enforce tenant/resource
   permissions on private reads and writes, preferably within the data operation.
   Cover unauthenticated access, cross-tenant access, and relevant races.
3. For uploads, enforce a product-specific extension/type allowlist, stream byte
   limits, and appropriate content validation. Magic headers alone do not prove
   safety. Use generated storage names and an isolated non-executable root; prevent
   traversal and symlink escapes. Serve potentially active content with appropriate
   isolation and headers. Bound archive expansion or decoding work when applicable.
4. For user-influenced outbound destinations, allowlist known services where possible.
   Parse URLs, restrict schemes, resolve and validate all IPv4/IPv6 addresses, and
   prevent DNS changes from bypassing connection checks. Disable redirects or validate
   each destination using the same policy. Block private, loopback, link-local,
   unspecified, and metadata targets unless a specific trusted internal service is
   intentionally allowed. Apply time, response-size, and network egress limits.
5. Redact credentials at logging/telemetry boundaries and keep public errors free
   of secrets and internal traces. Apply relevant session, CSRF, rate-limiting, and
   browser content controls using existing framework facilities.
6. Verify the changed boundary with meaningful negative cases under
   [shared verification](../../protocols/workflow.md#verification). Report actual
   protections and gaps; do not claim the whole app is secure from a checklist.

Use [the playbook](references/app-hardening-playbook.md) for implementation choices
and [the checklist](references/review-checklist.md) for an explicitly requested audit.
Local fixtures need deliberate configuration, not an automatic security bypass.