security
Apply security practices for the .NET 8 WPF widget host app: authN/authZ, secrets, encryption at rest, and secure local storage. Use when handling credentials, tokens, user data, or integrating identity providers.
When & Why to Use This Skill
This Claude skill facilitates the implementation of enterprise-grade security practices for .NET 8 WPF applications. It provides a structured framework for handling authentication, authorization, and sensitive data protection, ensuring that desktop apps meet modern security standards and compliance requirements. By automating the application of Windows DPAPI and secure storage patterns, it helps developers mitigate risks related to credential theft and PII leakage.
Use Cases
- Integrating Identity Providers: Setting up secure AuthN/AuthZ flows for user login and permission management within a WPF environment.
- Secrets Management: Replacing hardcoded credentials and plain-text configuration files with secure storage solutions like Windows DPAPI.
- Data Encryption at Rest: Implementing per-user encryption keys to protect sensitive local databases and application state files.
- Privacy Compliance & Auditing: Reviewing application logs and telemetry to ensure no Personally Identifiable Information (PII) is accidentally exposed during runtime.
| name | security |
|---|---|
| description | Apply security practices for the .NET 8 WPF widget host app: authN/authZ, secrets, encryption at rest, and secure local storage. Use when handling credentials, tokens, user data, or integrating identity providers. |
Security
Overview
Protect user data and credentials across local storage, network calls, and widget interactions.
Core areas
- Authentication and authorization
- Secrets management
- Encryption at rest
- Secure local storage
Definition of done (DoD)
- No secrets in source code or config files
- Sensitive data uses Windows DPAPI or equivalent
- Authorization checks happen at service boundaries, not UI
- Logs and telemetry are reviewed for PII before merging
- Password/token inputs are masked in UI
Guidance
- Do not store secrets in plain text or config files.
- Use OS-provided secure storage for tokens.
- Encrypt sensitive local data with per-user keys.
- Validate authorization in application services, not UI.
Workflow
- Identify data classified as sensitive.
- Select storage location and encryption strategy.
- Implement token handling and refresh flow.
- Validate authorization checks at service boundaries.
- Review logs and telemetry for PII leakage.
References
references/auth.mdfor authN/authZ patterns.references/secrets.mdfor secret storage rules.references/encryption.mdfor encryption at rest.references/secure-storage.mdfor Windows storage options.