security-basics
Apply project-specific security and privacy guardrails (auth, headers, rate limiting, logging). Use when touching authentication, request handling, metrics exposure, or anything that could leak sensitive data.
When & Why to Use This Skill
The security-basics Claude skill automates the application of essential security and privacy guardrails for web applications, specifically optimized for Go-based environments. It ensures robust authentication, secure header management, rate limiting, and protected metrics exposure to prevent sensitive data leaks and enhance overall system integrity through a standardized review checklist.
Use Cases
- Hardening Authentication: Transitioning from legacy or hardcoded tokens to secure, environment-variable-based authentication (AUTH_TOKENS) to prevent credential exposure in source code.
- Traffic & Rate Limit Configuration: Implementing IP-based rate limiting and securing forwarding headers (X-Forwarded-For) to mitigate spoofing and brute-force attacks.
- Information Leakage Prevention: Securing public metrics endpoints and hardening error responses to ensure internal system details and secrets are never revealed to end-users.
- Production Environment Readiness: Auditing and applying production-grade CORS policies and enabling secure cookies for applications deployed behind HTTPS.
| name | security-basics |
|---|---|
| description | Apply project-specific security and privacy guardrails (auth, headers, rate limiting, logging). Use when touching authentication, request handling, metrics exposure, or anything that could leak sensitive data. |
| license | MIT |
| compatibility | Applies to the mjrwtf Go server; requires bash and git for repo work. |
| repo | mjrwtf |
| runner | github-copilot-cli |
| version | 1.3 |
| allowed-tools | Bash(git:*) Bash(go:*) Bash(make:*) Read |
Tooling assumptions
- Use a terminal runner with bash and git available.
- Prefer
maketargets when available; fall back to direct CLI commands when needed.
Authentication & secrets
- Auth tokens:
AUTH_TOKENS(preferred; comma-separated) orAUTH_TOKEN(legacy; single token). - Never hardcode tokens; use environment variables.
- Avoid logging full URLs, tokens, session cookies, or authorization headers.
Rate limiting & client IP
- The rate limiter keys by client IP and may use
X-Forwarded-For/X-Real-IP. - In production, ensure the reverse proxy strips/overwrites forwarding headers to prevent spoofing.
Metrics exposure
/metricsmay be public by default; enable protection when needed viaMETRICS_AUTH_ENABLED=true.
Practical review checklist
- Inputs validated (especially short codes and URLs).
- Error responses don’t reveal internals/secrets.
- CORS settings (
ALLOWED_ORIGINS) are appropriate for production. - Secure cookies enabled (
SECURE_COOKIES=true) when behind HTTPS.