security-overview_skill

Overview

This skill explains the defense-in-depth security architecture used by Secure Vibe Coding OS. It summarizes the five-layer security stack, core principles (fail-secure, least privilege), and the project's OWASP baseline so you can quickly assess the overall security approach. Use it to decide which targeted security skills to apply for a given API route or integration.

How this skill works

The skill breaks the request path into five layers: security headers middleware, rate limiting, CSRF protection, input validation, and secure error handling, with business logic protected in the middle. It maps each layer to concrete controls (CSP, HSTS, HMAC-SHA256 CSRF tokens, Zod validation, Clerk auth) and shows how to compose them in API routes. It also explains environment-specific behavior and when to call other security skills.

When to use it

• When you need an executive summary of the app’s security posture or OWASP score
• When designing a new API route and choosing which protections to apply
• When deciding whether to enable relaxed dev settings or strict production controls
• When integrating third-party services (payments, auth, database) and checking responsibilities
• When evaluating an AI-generated feature for secure defaults

Best practices

• Always apply withRateLimit on public or expensive endpoints
• Use withCsrf for state-changing requests (POST/PUT/DELETE)
• Validate and sanitize all user input with Zod before business logic
• Fail-secure: return generic errors in production and avoid logging PII
• Run dependency and security audits before adding packages

Example use cases

• Protecting a contact form: compose withRateLimit + withCsrf + Zod validation + handleApiError
• Creating a user-only endpoint: withRateLimit + auth() check + minimal response data
• Adding a public newsletter signup: rate limit + input validation, no auth required
• Implementing Stripe webhooks: verify signatures, use payment-security skill, never log card data