secure-code-reviewlisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/secure-code-review/SKILL.md. --> # Secure Code Review Apply OWASP Top 10 and CWE Top 25 patterns during code generation and review ## ALWAYS - Use parameterized queries / prepared statements for all database access. Never build SQL by string concatenation, even for "trusted" inputs. - Validate input at the trust boundary — type, length, allowed characters, allowed range — and reject before processing. - Encode output for the rendering context (HTML escape for HTML, URL encode for query params, JSON encode for JSON output). - Use the language's built-in cryptography library, never custom-rolled crypto. Prefer AES-GCM for symmetric encryption, Ed25519 / RSA-PSS for signatures, Argon2id / bcrypt for password hashing. - Use `crypto/rand` (Go), `secrets` module (Python), `crypto.randomBytes` (Node.js), or the platform CSPRNG for any random value involved in security (tokens, IDs, session keys). - Set explicit security headers on HTTP responses: `Content-Security-Policy`, `Strict-Transport-Security`, `X-Content-Type-Options: nosniff`, `Referrer-Policy`. - Use the principle of least privilege for file paths, database users, IAM policies, and process privileges. ## NEVER - Build SQL/NoSQL queries by string concatenation with user input. - Pass user input directly to `exec`, `system`, `eval`, `Function()`, `chil