securitylisted

# Security Use this skill when a task creates, changes, reviews, or fixes a security-sensitive application boundary. The rules in this skill are framework and language agnostic. Do not assume a specific framework, ORM, authentication library, HTTP server, database, queue, cloud provider, or deployment platform. ## Core Principle Identify the security boundary first. Then use the safest native mechanism available in the detected project stack. Technology-specific implementation details should be derived from project evidence, native stack mechanisms, or relevant user-installed specialist skills rather than hardcoded into this skill. ## Security Review Scope Check only areas relevant to the change. Primary areas: - authentication - authorization - input validation - output encoding - request forgery protection - injection - secret handling - sensitive data exposure - file uploads - API security - rate limiting and abuse protection - session and token handling - dependency and configuration security - logging and error disclosure - unsafe redirects and outbound requests - serialization and deserialization - access to filesystem, network, subprocesses, and other privileged resources Do not mechanically run every category for every task. ## 1. Trust Boundaries Treat data crossing a trust boundary as untrusted until validated. Common boundaries include: - HTTP requests - API payloads - form input - URL parameters - headers - cookies - uploaded files - webhooks - mes