security-compliance
Implement comprehensive security for shared library. Use when working with security audits, dependency vulnerabilities, API security, token encryption, or secure coding practices for library consumers. Library security impacts all consuming plugins.
When & Why to Use This Skill
The Security & Compliance Guardian skill is designed to fortify shared libraries by automating security audits, managing dependency vulnerabilities, and enforcing secure coding standards. It provides a comprehensive framework for implementing robust data protection, secure API design, and supply chain security, ensuring that all consuming applications inherit a secure-by-default foundation.
Use Cases
- Vulnerability Remediation: Identifying and patching critical CVEs in third-party dependencies and issuing security advisories for library consumers.
- Cryptographic Implementation: Integrating cross-platform token encryption using DPAPI, Keychain, and Secret Service, or leveraging Azure Key Vault for secure storage.
- Automated Security Auditing: Utilizing CodeQL, GitLeaks, and OpenSSF Scorecards to maintain continuous security compliance and secret scanning.
- Secure API Architecture: Designing APIs with built-in input validation, output sanitization, and fail-secure error handling to prevent information leakage and injection attacks.
| name | security-compliance |
|---|---|
| description | Implement comprehensive security for shared library. Use when working with security audits, dependency vulnerabilities, API security, token encryption, or secure coding practices for library consumers. Library security impacts all consuming plugins. |
Security & Compliance Guardian
Mission
Ensure Lidarr.Plugin.Common provides secure foundation for all consuming plugins through comprehensive security practices and secure defaults.
Current Security Infrastructure
- ✅ CodeQL Scanning: Weekly automated scans
- ✅ Secret Scanning: GitLeaks active + historical
- ✅ Dependency Review: PR-based vulnerability checks
- ✅ OpenSSF Scorecard: Weekly security assessment
- ✅ Token Encryption: DPAPI/Keychain/SecretService support
- ✅ Azure Key Vault: Optional encrypted storage
Library-Specific Security
Secure Defaults
- All APIs secure by default
- No insecure opt-in options
- Fail-secure error handling
- Encrypted token storage
Consumer Impact
- Security issues affect ALL plugins
- Breaking fixes may require major versions
- Clear security migration guides
- Responsible disclosure process
Expertise Areas
1. Secure API Design
- Input validation patterns
- Output sanitization
- Error handling without information leakage
- Cryptographic best practices
2. Authentication Security
- OAuth 2.0 + PKCE implementation
- Token storage encryption
- Session management security
- Credential rotation support
3. Data Protection
- At-rest encryption (DPAPI, Keychain, Secret Service)
- In-transit security (TLS/HTTPS enforcement)
- Azure Key Vault integration
- Secure cache management
4. Supply Chain Security
- Package signing (NuGet)
- Dependency pinning and lock files
- SBOM for library releases
- Transitive dependency monitoring
5. Vulnerability Management
- CVE monitoring and response
- Security advisory creation (GitHub)
- Breaking security fixes process
- Backport security patches to old versions
Enhancement Opportunities
- Package Signing: Sign NuGet packages with certificate
- Security Documentation: Consumer security guide
- Threat Model: Library-specific threat analysis
- Fuzzing: Add fuzz testing for parsers and validators
- Penetration Testing: Regular third-party security audits
Security Checklist for Library
- All APIs have input validation
- Secrets encrypted at rest
- TLS/HTTPS enforced
- No default credentials
- Secure error messages
- Regular dependency updates
- Security advisories documented
- Breaking security fixes have migration guide
Related Skills
api-versioning- Security through API contractsrelease-automation- Secure releases with SBOM
Examples
Example 1: Handle Security Vulnerability in Dependency
User: "FluentValidation has a critical CVE" Action: Assess impact, update version, test compatibility, create security advisory, release patch for supported versions
Example 2: Add Token Encryption
User: "Implement encrypted token storage" Action: Use DPAPI (Windows), Keychain (macOS), Secret Service (Linux), add Azure Key Vault support, document usage
Example 3: Security Audit Findings
User: "Penetration test found API key in logs" Action: Remove sensitive data from logs, add log scrubbing, update documentation, release hotfix, notify consumers