security-baseline
Security requirements, threats, and controls that apply across this system.
When & Why to Use This Skill
This Claude skill provides a comprehensive framework for establishing a robust security baseline across any system. It streamlines the identification of high-level threat models and the implementation of essential security controls, including authentication, authorization, and secrets management, ensuring that applications are built with a security-first approach to mitigate risks like data exfiltration and unauthorized access.
Use Cases
- Threat Modeling: Identifying primary assets such as customer PII and payment data to define specific threats and protection strategies.
- Security Control Implementation: Establishing standardized protocols for OAuth2/SSO authentication and enforcing least-privilege authorization across the system.
- Secure Development Lifecycle: Providing developers with clear guidelines for input validation, output encoding, and secure secrets management to prevent common vulnerabilities.
- Compliance and Auditing: Creating a centralized log of security-relevant events and audit trails to meet regulatory requirements and internal security policies.
| name | security-baseline |
|---|---|
| description | Security requirements, threats, and controls that apply across this system. |
Security Baseline
Threat Model (High Level)
- Primary users: [internal / external]
- Assets to protect:
- [e.g., customer PII, payment data, secrets]
- Primary threats:
- [e.g., unauthorized access, data exfiltration, data tampering]
Required Controls
Authentication
- Use [e.g., OAuth2 / OIDC / SSO] for user identity.
- Never build custom password handling if avoidable.
Authorization
- Enforce least privilege.
- Centralize authorization decisions when possible.
Input Validation & Output Encoding
- Validate all untrusted input at boundaries.
- Sanitize or encode output where appropriate (HTML, JSON, SQL, etc.).
Secrets Management
- Store secrets in [vault / secret manager], never in code or config files.
- Rotate secrets according to policy.
Logging & Auditing
- Log security-relevant events:
- Logins, permission changes, critical operations.
- Avoid logging sensitive data.
Common Vulnerabilities
See vulnerabilities.md for patterns to search for and avoid.
Security Testing Requirements
See security-testing.md for:
- Required automated checks
- Manual review steps for critical flows