craft-securitylisted

# Security Craft This skill encodes one engineer's standard for defensive security, applied the same way across every repo. The **method and opinions** live here; the **project specifics** (which auth provider, which secret store, which validation library) live in the target repo's code and config — always discover them, never assume or hardcode. ## Operating principle — discover before you build Different repos already have different pieces in place. Before changing anything, spend a few minutes mapping the current posture so you extend rather than conflict: - `package.json` / lockfile → which auth library, validation library, and HTTP framework are present? - `grep` for an existing env schema (`env.ts`, `config.ts`) — are secrets loaded through a validated schema or read raw from `process.env`? - Check for an existing middleware file or proxy entry point — are security headers already set, and where? - Scan `package.json` for known-vulnerable pinning patterns; note whether a dependency scanner (`npm audit`, Snyk, Dependabot) is wired into CI. - Look at existing route handlers — is authorization checked once in middleware, per-route, or not at all? State what you found, then propose the smallest set of changes that closes the gaps. ## The security layers (work in this order) 1. **Authorization & auth-flow security** — enforce least-privilege on every resource (a valid session does not mean access to everything), and apply the security *standard* for the