pattern-engineer-security

Security guardrails for production-code authoring. This skill is a quiet reference catalogue — the agent reads it to know which patterns to follow, not a checklist to walk through with the user. Reviewer feedback is the user-facing channel for security findings; this skill exists so most findings never happen.

When to activate

• Writing or editing any production code that touches secrets, user input, queries, auth / sessions, output rendering, CSRF, rate limits, logging, errors, dependencies, outbound HTTP, webhooks, CORS, file uploads, or balance / quota / token mutations.
• Do NOT activate for purely cosmetic changes (formatting, renaming an internal-only variable, comment edits) or conceptual questions that don't touch code.

Project memory overlay

After loading this skill, also check $MAIN_ROOT/.claude/memory/patterns/pattern-engineer-security.md in the consuming project (resolve MAIN_ROOT="$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)")"). If present, load it as an additive overlay to the rules below; if absent, skip silently. See memory-convention for the full contract (additivity, severity floor, conflict surfacing).

Always do (no exceptions)

• Validate every external input with a schema at the boundary (Zod / Pydantic). Bound string lengths, numeric ranges, enum values. Trust internal callers; never trust the network.
• Parameterize every database query — ORM or bound parameters. Never concatenate / f-string user input into SQL, shell commands, file paths, or eval. Dynamic table / column names come from a hardcoded whitelist.
• Hash passwords with argon2id (preferred) / bcrypt(≥12) / scrypt. Never store plaintext. Use the library's constant-time verify — never == or bcrypt.compare without await.
• Run constant-time on auth enumeration paths. Login / forgot-password verify against a sentinel hash when the account doesn't exist so timing leaks exists vs doesn't exist. Pin the floor with a regression test.
• Set session cookies HttpOnly; Secure; SameSite=Strict (or Lax if cross-site nav is required). The Secure / SameSite attributes come from an env knob (SECURE_COOKIES, default true) read at the call site — not from a fully-populated Settings() that test fixtures can't satisfy. Store auth tokens in cookies, never localStorage.
• Authorize before acting. Every handler that mutates state checks identity AND ownership/role server-side — authentication answers "who is this?", authorization answers "are they allowed to do this to this resource?" (skipping the second produces IDOR). Multi-tenant tables get RLS where the DB supports it.
• Encode output / sanitize HTML before render. React escapes by default; reach for dangerouslySetInnerHTML only after a sanitizer (DOMPurify / bleach) with an allowlist of tags + attributes.
• Set the full security-header set at the edge: CSP (default-src 'self', frame-ancestors 'none'), HSTS (max-age=31536000; includeSubDomains), X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy disabling unused capabilities.
• CSRF token on every cookie-authed state-changing request. Pair with SameSite cookies as defense-in-depth.
• Rate-limit every public endpoint — per-IP at minimum, per-user on authenticated routes. Stricter limits on auth-adjacent routes (login, signup, forgot-password, token-refresh). Rate-limit responses use 429 + Retry-After.
• Read secrets from env vars (or a typed Settings that does). .env*, *.pem, *.key in .gitignore; only .env.example (placeholder values) committed. If a secret leaked, rotate it — purging git history is not enough.
• Lock dependencies. Commit package-lock.json / uv.lock / poetry.lock; CI uses npm ci / uv sync --locked / poetry install --no-update.
• Atomic mutations for balance / quota / token redemption. UPDATE … SET balance = balance - :a WHERE … AND balance >= :a (check rowcount), or SELECT … FOR UPDATE inside a transaction. Token redemption (reset, MFA, OTP, magic-link) marks-then-checks atomically so second attempt returns rowcount=0.
• Validate JWTs when used. Signature + algorithm (reject alg: none) + exp + iss + aud where relevant.
• Sessions can be revoked. Server-side session store, or short-lived JWT + refresh-token rotation with a revocation list — never a long-lived bearer JWT with no revocation path.
• Reset tokens are time-limited (≤1 hour) and single-use. Password-reset completion does NOT issue a session and does NOT auto-navigate to authed routes — the server returns 204 and the SPA navigates to /login.
• CORS origin is an explicit env-driven list. Never * in production; especially never * with credentials: true. methods and allowedHeaders are explicit, not *.
• SSRF guard on user-controlled outbound URLs. Host allowlist + scheme allowlist (https:) + block private/link-local/loopback ranges (resolve the hostname; don't trust the literal) + redirect: "manual" + timeouts.
• Verify webhook signatures (HMAC) before parsing the body. Constant-time compare (timingSafeEqual / hmac.compare_digest). Replay protection by event-ID dedupe or timestamp window.
• OAuth public clients use PKCE; every OAuth callback validates state. Third-party CDN <script> tags carry SRI hashes (integrity="sha384-..." + crossorigin="anonymous").
• Container images scanned before they ship. Trivy / Docker Scout / Grype against the slug-tagged image; CRITICAL/HIGH count must be 0; MEDIUM/LOW counts reported.

Never do

• Commit secrets — API keys, tokens, passwords, signing keys, connection strings.
• Log passwords, tokens, full PANs, CVVs, full SSNs, session IDs, raw user-supplied emails on failure paths. Log identifiers (user_id, request_id), not secrets.
• Log the same sensitive value at two layers — pick one (usually the outermost where the value is still in scope) and log there only.
• Trust client-side validation as a security boundary.
• Disable security headers, CSRF, rate limits, or CSP rules to make a feature work — if they're in the way, satisfy them.
• Use eval() / innerHTML / dangerouslySetInnerHTML / v-html with raw user input.
• Store sessions in localStorage, sessionStorage, or any JS-accessible storage.
• Expose stack traces, internal exception messages, schema names, or table names in 5xx (or 4xx) responses — generic message + correlation ID.
• Auto-login on password-reset completion. Consume the token, update the hash, return 204; the SPA navigates to /login.
• Wildcard CORS with credentials. origin: '*' + credentials: true is an exfiltration channel.
• fetch(userProvidedUrl) server-side without a host allowlist + private-IP-range block.
• Compare HMAC / MAC / signatures with ==. Use a constant-time compare.
• Concatenate / interpolate user input into SQL, shell commands, file paths, or eval.
• Pre-create extensions / fixtures in shared session-scope test setup that the migration is supposed to install — the migration must own its own lifecycle.
• Use SHA-256 / MD5 for password hashing (those are checksums, not password hashes).
• Reveal in error bodies or timing whether a user / email exists — for auth flows, prefer "if an account exists, we sent an email".

Quick lookup — patterns by surface

Every rule above is binding regardless of project stage — "internal tool", "prototype", and "we'll add it later" do not waive a row. pattern-reviewer-security audits against this same catalogue; close the gap while authoring rather than in a fix cycle.