securelisted

# secure Use for any work touching secrets, auth, config, deployment, MCP definitions, memory stores, risky dependencies, user input handling, database queries, file operations, cryptography, or infrastructure code. **Integrated guidance:** This skill now consolidates three security skill areas: - **Operational security** (secrets, credentials, configs, deployment) — check list below - **Web application & infrastructure best practices** (HTTPS, CORS, CSRF, rate limiting, auth) — see `references/best-practices.md` - **Secure coding** (SQL injection, XSS, command injection, code patterns across 10+ languages) — see `references/secure-coding.md` ## Check list ### Credentials and secrets - inline tokens, API keys, bearer headers, or credentials - secret-bearing files accidentally modified (.env, .pem, .p12) - hardcoded usernames, passwords, or API keys - private keys or certificates committed to git ### Code security (when reviewing or writing code) - SQL injection risk (string concatenation, format strings in queries) - XSS risk (unescaped HTML output, innerHTML, user input in templates) - Command injection (shell=True, shell expansions with user input) - Path traversal (user-controlled file paths without validation) - Code injection (eval, exec with user input) - Insecure deserialization (pickle, ObjectInputStream, Marshal.load with untrusted data) - XXE risk (XML parsers with external entity processing enabled) - Hardcoded secrets or API keys in code ### Configuration